USB part 5Flash Extractor-芯片级数据恢复取证方案025-83608636

USB part 5

Monolith USB_88 45 49 9b b3 1x1 v2

Layout
  20-82-00515-5 14_2048_230 Xor C634 16_2
Mix
  Input
    Order  0
  Block Pair
    Block  0xc00000
    Page   0x4000
  Block Pair
    Block  0x8a9000000
    Page   0x8000
  Block Pair
    Block  0x1152000000
    Page   0x10000
Assembler
  Sector Number Slow
    Sector Size     0x1000
    Scan file name  SN_Slow.scan
Comments
  by Arvika
  ID: 45 49 9b b3 7e 72
  Statistics: 
  RAW scan on RAW image with mix: 40% good photos
  Model Monolith_USB_88_v1 - RAW scan on disk.image give 67% good photos (withou
t mix)
  Model Monolith_USB_88_v2 - RAW scan on disk.image give 80% good photos (with m
ix)

Monolith USB_100 98 de 98 92 1x8

Layout
  SM3257 1144_27 Xor b36e_256
Mix
  Input
    Order  0/1/2/3/4/5/6/7
  Cut Bad Bytes
  Block Pair
    Block  0x204000
    Page   0x2000
  Join by Page
    Parts  4
    Page   0x4000
  Join by Dump
    Parts  2
Assembler
  Block Number
    Block Size      0x1020000
    Banks           0..15 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  By Recover My Flash Drive (jeremyb)
  Chip has 8CE's all must be pulled HIGH/LOW to read NAND
  Find RR SanDisk v1 on EVEN/ODD blocks and ECC Combine to
  improve read quality. 100% Recovered

Monolith USB_101 45 4c a8 92 1x1

Layout
  AU6998 1138 Xor 6771_258 BP +0x2000 aECC
Mix
  Input
    Order  0
  Software Bad Bytes
    Block  258
    Group  4
  Block Pair
    Block  0x204000
    Page   0x2000
  Block Pair
    Block  0x408000
    Page   0x4000
Assembler
  Block Number
    Block Size   0x810000
    Bank Space   0x4000
    Banks        00 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  Serg for forum 12357

Monolith USB_102 ec 1c d9 1f 1x4

Layout
  SM3257_41 1150_27 Xor 8e3d_384
Mix
  Input
    Order  2/0/1/3
  Join by Page
    Parts  4
    Page   0x4000
  Block Pair
    Block  0x1800000
    Page   0x10000
Assembler
  Block Number
    Block Size      0x3000000
    Banks           00..15 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  By JeremyB
  Read NAND at 2.05v
  Auto Conflicts picked the wrong block 0.
  100% Recovered

Monolith USB_103 ad de 94 d2 1x4

Layout
  SM3254 1066 v3 Xor 0006 64
Mix
  Input
    Order  1/3/0/2
  Block Pair
    Block  0x200000
    Page   0x2000
  Join by Page
    Parts  2
    Page   0x4000
  Join by Dump
    Parts  2
Assembler
  Block Number
    Block Size      0x800000
    Banks           00..15 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  by Arvika
  Dump order can be other

Monolith USB_104 98 3c 98 b3 1x1

Layout
  TC58NC6626 1218 Xor 80809e9e_256
Mix
  Input
    Order  0
  Block Cut
    Block  0x3C00/0x400
Assembler
  Virtual Translator
    Block Size  0x5a0000
Comments
  By JeremyB
  100% Recovered, ECC Writeback doesn't work, uses Auto Fast with
  ECC = Off then ECC = On

Monolith USB_105 45 3a a4 93 1x1 Ref

Layout
  SM3259 1108_31 Xor 17fe_256 bb
Mix
  Input
    Order  0
Assembler
  Block Number
    Block Size   0x400000
  Actions
    Scan
    Find Bank Size
Comments
  Serg for forum 12378
  
  Split by Block 4, 0x45D000 
  
  Put in folders Split_0, Split_1, Split_2, Split_3 
  Add FE folder 
  
  Split_0 was empty
  
  Make image for each folder  
  
  Save 1,2,3 images
  
  Make somehow Join by Dump 
  for example: 
  copy /b 1.image + 2.image + 3.image FINAL.image 
  in windows comsole 
  
  Few folders, files is red, because of conflicts 
  But most of files is OK

Monolith USB_106 45 3c 98 b3 1x2 Ref

Layout
  SM3259_41 1140_31 Xor 17fe_256 bb
Mix
  Input
    Order  0/1
  Software Bad Bytes
    Block  128
    Group  1
  Block Cut
    Block  0x900000/0x300000
Assembler
  Block Number
    Block Size   0x900000
  Actions
    Scan
    Find Bank Size
Comments
  Serg for forum 12391
  
  Split by Block 2, 0xD6E000 for each dump 
  
  Put in folders:
  01_01 -> Split_0, Split_1
  01_02 -> Split_2, Split_3
  
  In each folder rename dump to 01_01.dump
  Copy FE folder
  Put Job_N.txt (attached)
  
  ECC Fix
  ECC Off
  Save Image
  
  Join by Page 2, 0x4000 - Split_0, Split_1 -> 01.image
  Join by Page 2, 0x4000 - Split_2, Split_3 -> 23.image
  
  Join by Dump  01.image, 23.image -> FINAL.image
  
  Can do with windows console:
  copy /b 01.image + 23.image FINAL.image

Monolith USB_107 ec 1e 98 3f 2x2

Layout
  SM3280 32_1146_2_32 LE2 LE2 Xor 17fe_768 SA
Mix
  Input
    Order  0/2/1/3
  Join by Page
    Parts  2
    Page   0x4000
  Block Pair
    Block  0x1800000
    Page   0x8000
  Join by Page
    Parts  2
    Page   0x10000
Assembler
  Sector Number Slow
    Sector Size     0x1000
Comments
  by Bolo
  ECC = Check
  Scan
  ECC = Off
  Check Conflicts
  Save Image or Save Root

Monolith USB_108 98 de 88 a3 1x1

Layout
  DM 1144_1152 Xor e88a_128
Mix
  Input
    Order  0
  bn to sn
    Sectors  0x400
Assembler
  Sector Number Slow
    Sector Size     0x4000
Comments
  Serg for forum 12431

Monolith USB_109 ad 3a 14 03 1x1

Layout
  AU6998 1110 Xor 6771_256
Mix
  Input
    Order  0
  Software Bad Bytes
    Block  388
    Group  2
  Cross Bank
    Block  0x610000
    Bank   0x552
Assembler
  Block Number
    Block Size   0x610000
    Bank Space   0x552
  Actions
    Scan
    Read Bank Size
Comments
  Serg for forum 12417

Monolith USB_110 45 48 9a b3 1x1

Layout
  20-82-00515-5 14_2048_230 Xor C634 16_2
Mix
  Input
    Order  0
  Block Pair
    Block  0x1800000
    Page   0x4000
  Block Pair
    Block  0xc00000000
    Page   0x8000
  Block Pair
    Block  0x1800000000
    Page   0x10000
Assembler
  Sector Number Slow
    Sector Size     0x1000
Comments
  by Bolo

Monolith USB_110 89 a4 08 32 1x1

Layout
  FC1178 1154_1150
Mix
  Input
    Order  0
  Xor 21cd
    Page   0x4000
    Group  4
  Divide
    Field  Block Number
    Value  0x1200
  Cross Block
    Field  Block Number
    Block  0x2400000
    Parts  2
    Step   1
Assembler
  Block Number
    Block Size   0x2400000
    Bank Space   0x4000
    Banks        00 / 0x000 / 0x3ff
    Mix          2 / 0x4000
    
    Scan Max     1
  Actions
    Scan
Comments
  Serg for forum 12428
  
  I do not found file system 
  
  With Raw Recovery i get 7 good jpegs

Monolith USB_111 45 3c 98 b3 1x1

Layout
  FC1178 1144_1140
Mix
  Input
    Order  0
  Xor 21cd
    Page   0x4000
    Group  4
Assembler
  Raw
    Block Size  0x20000
Comments
  Serg for forum 12555

Monolith USB_112 98 3e 98 b3 1x2

Layout
  SM3281_BN 32_1140 Xor 17fe bb
Mix
  Input
    Order  0/1
  Block Cut
    Block  0x1200000/0x600000
  Join by Page
    Parts  2
    Page   0x2400000
  Cross Block
    Field  Block Number
    Block  0x1200000
    Parts  4
    Step   1
Assembler
  Block Number
    Block Size   0x1200000
    Bank Space   0x4000
    Banks        00 / 0x000 / 0x1fff
    Mix          4 / 0x4000
  Actions
    Scan
Comments
  Serg for forum 12576

Monolith USB_113 ad 3a 14 03 1x1

Layout
  Unknown 32_1124 Xor 17fe
Mix
  Input
    Order  0
  Block Pair
    Block  0x610000
    Page   0x4000
Assembler
  Block Number
    Block Size   0xc20000
    Bank Space   0x4000
    Banks        00 / 0x000 / 0x551
  Actions
    Scan
Comments
  Serg for forum 12593

Monolith USB_114 45 40 9b b3 1x2

Layout
  20-82-00515-5 14_2048_230 Xor C634 16_2
Mix
  Input
    Order  0/1
  Join by Dump
    Parts  2
Assembler
  Sector Number Slow
    Sector Size     0x1000
Comments
  by Arvika
  ID: 45 40 9b b3 7e 6b

Monolith USB_115 45 3c 98 b3 1x1

Layout
  SM3281_BN 32_1142 Xor 17fe bb
Mix
  Input
    Order  0
  Software Bad Bytes
    Block  1536
    Group  1
  Block Cut
    Block  0x1200000/0x600000
Assembler
  Block Number
    Block Size   0x1200000
    Bank Space   0x4000
    Banks        00 / 0x000 / 0x3ff
Comments
  by Arvika
  ID: 45 3c 98 b3 76 6b
  SBB: Auto ff, BB only on Split1
  Split by Block 0x1adc000
  Create folder Split_0, Split_1
  Put new dumps in this folders
  Copy FE folder here
  for Split_0 layout
  SM3281_BN 32_1142 Xor 17fe bb
  for Split_1 layout
  SM3281_BN 32_1140 Xor 17fe bb
  For each folder 
    ECC Fix 
    ECC = Off 
    Save Image 
  Solve conflicts if need
  Make Join by Page 0x4000 for created images
  This will be final image

Monolith USB_116 98 3a a8 92 1x1

Layout
  SM3257 1130 Xor b36e_256
Mix
  Input
    Order  0
  Cut Bad Bytes
  Block Pair
    Block  0x204000
    Page   0x2000
  Block Pair
    Block  0x408000
    Page   0x4000
Assembler
  Block Number
    Block Size      0x810000
    Banks           0..7 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  By JeremyB
  Read using DDR = On
  RR using SanDisk v7

Monolith USB_117 98 3a 98 a3 1x2

Layout
  SM3257_41 1144_27 Xor b36e_256
Mix
  Input
    Order  0/1
  Block Pair
    Block  0x600000
    Page   0x4000
  Join by Dump
    Parts  2
Assembler
  Virtual Translator
    Block Size  0xc00000
Comments
  By JeremyB
  SA had no sector numbers.
  Had to use both VT and TT to assemble the image.
  To find TT read the chip in A2
  Block 0xbc040, Blocks 0x11c, Skip_Page_1 0x2a
  Load with same Layout and search for e6 marker / tt blocks
  tt stored in 16bit big endian.
  Write script to convert tt to vt format. Load into VT.
  100% Recovered

Monolith USB_118 32 2c c3 08 1x1

Layout
  SM3281_BN 32_1150 Xor 17fe bb
Mix
  Input
    Order  0
  Block Pair
    Block  0x3600000
    Page   0x4000
Assembler
  Block Number
    Block Size   0x6c00000
    Bank Space   0x4000
  Actions
    Scan
Comments
  By JeremyB
  This flash memory chip is a nightmare to read. Below 1.8v and no data is read,
 above 2.0v and it won't ID.
  Inbetween and mixed data might be returned. Chip is really 2c c3 08 32 but bec
ause of DDR weirdness it
  returns as 32 2c c3 08
  
  Chip.txt:
  
  // Chip
  Company      Micron
  Name         MT29F512G08EBLCE3W
  ID code      32 2c c3 08
  
  // Structure
  Bus          8
  Banks        1 x 64GB
  Page         18592
  Block        0x3d47000
  Blocks       0x548
  
  // Read
  Cmd          05_E0
  Col          2
  Row          3
  DDR          true
  
  // Special
  Skip_Mask_1  0xfff
  Skip_Page_1  0xd80

Monolith USB_119 45 3a 94 93 1x1

Layout
  SM3259 1102_31 Xor 17fe_256
Mix
  Input
    Order  0
Assembler
  Block Number
    Block Size      0x400000
  Actions
    Scan
    Find Bank Size
Comments
  by Bolo

Monolith USB_120 ec 1e 98 3f 1x1

Layout
  SM3280 32_1146_2_32 LE2 LE2 Xor 17fe_768 SA
Mix
  Input
    Order  0
  Block Pair
    Block  0xc00000
    Page   0x4000
Assembler
  Sector Number Slow
    Sector Size     0x1000
Comments
  By JeremyB
  Used SLC Custom Assembler... Perfect Recovery
  Read NAND with Voltage Adapter

Monolith USB_121 98 3a a8 92 1x2

Layout
  SM3257 1144_27 Xor b36e_256
Mix
  Input
    Order  0/1
  Cut Bad Bytes
  Block Pair
    Block  0x204000
    Page   0x2000
  Block Pair
    Block  0x408000
    Page   0x4000
  Join by Page
    Parts  2
    Page   0x8000
Assembler
  Block Number
    Block Size      0x1020000
    Banks           00..07 / 0x000 / 0x0ff
  Actions
    Scan
    Find Bank Size
Comments
  by Arvika

Monolith USB_122 45 40 98 b3 1x1

Layout
  20-82-00515-5 14_2048_230 Xor C634 16_2
Mix
  Input
    Order  0
Assembler
  Sector Number Slow
    Sector Size     0x1000
Comments
  Read with config for 0x454899b3 and increased
  amount of blocks (0x10000) - for RR use Sandisk v2.
  After fix can use model
  by Bolo

Monolith USB_123 ad 3a 14 03 1x1

Layout
  PS2251 1128_1124 Xor 0561_256 v3
Mix
  Input
    Order  0
  Software Bad Bytes
    Block  388
    Group  2
Assembler
  Block Number
    Block Size      0x610000
    Bank Space      0x4000
    Banks           00 / 0x000 / 0xaa3
  Actions
    Scan
Comments
  Serg for forum 12633

Monolith USB_124 98 3a a8 92 1x4

Layout
  PS2251 1138_1134 Xor 0561_86
Mix
  Input
    Order  0/1/2/3
  Software Bad Bytes
    Block  258
    Group  4
  Block Pair
    Block  0x204000
    Page   0x2000
  Join by Page
    Parts  2
    Page   0x4000
  Join by Dump
    Parts  2
  Cross Bank
    Block  0x810000
    Bank   0x800
Assembler
  Block Number
    Block Size   0x810000
    Bank Space   0x800
    Banks        0..3 / 0x000 / 0x744
  Actions
    Scan
Comments
 by Bolo
 Modified USB_56 model. 
 Need to find Software Bad bytes and cut it manually
 袪ardware BB not works.
 Read at 3.45V for correct image
 Perfect Recovery !

Monolith USB_125 45 3c 98 b3 1x1

Layout
  PS2251 1144_1140 Xor 0561_0x600 v3
Mix
  Input
    Order  0
  Software Bad Bytes
    Block  1536
    Group  2
  Block Cut
    Block  0x1200000/0x600000
Assembler
  Block Number
    Block Size      0x1200000
    Bank Space      0x4000
    Banks           00 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  by Arvika
  ID: 45 3c 98 b3 76 6b
  SBB: Auto ff + manual adjust

Monolith USB_126 ad 5c 28 ba 1x1

Layout
  AU6998 1138 Xor 6771_384_256 aECC
Mix
  Input
    Order  0
  Software Bad Bytes
    Block  1152
    Group  4
  Cross Bank
    Block  0x1200000
    Bank   0x3b6
  Cross Bank
    Block  0x900000
    Bank   0x3b6
Assembler
  Block Number
    Block Size   0x900000
    Bank Space   0x3b6
  Actions
    Scan
    Read Bank Size
Comments
  Serg for forum 12676

Monolith USB_127 45 4c 98 a3 1x1

Layout
  SM3259 604_31 Xor 17fe_256 bb
Mix
  Input
    Order  0
  Software Bad Bytes
    Block  384
    Group  2
  Block Cut
    Block  0x3C00/0x400
  Cross Bank
    Block  0x5a0000
    Bank   0x5a8
Assembler
  Block Number
    Block Size   0x5a0000
    Bank Space   0x5a8
  Actions
    Scan
    Find Bank Size
Comments
  Serg for forum 12705
  
  For bb use Auto_ff

Monolith USB_128 2c 84 48 63 1x4

Layout
  SM3257 1150_27 Xor 2850_256
Mix
  Input
    Order  0/1/2/3
  Block Cut
    Block  0x5ea000/0x2000/0x4000/0x2000/0x4000/0x2000/0x4000/0x2000/0x2000
  Block Pair
    Block  0x5f8000
    Page   0x2000
  Join by Dump
    Parts  4
Assembler
  Block Number
    Block Size      0xbf0000
    Banks           00..19 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  Arvika for forum 12718
  chip read with CMD=HybridX3

Monolith USB_129 45 3e 98 b3 1x1

Layout
  SM3259_41 1140_31 Xor 17fe_256 bb
Mix
  Input
    Order  0
  Software Bad Bytes
    Block  1536
    Group  1
  Block Cut
    Block  0x1200000/0x600000
Assembler
  Block Number
    Block Size   0x1200000
    Banks        00..06 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  Arvika for forum 12747
  ID: 45 3e 98 b3 76 6b
  SBB: Auto ff + manual correction
  Split by Block 2, 0x1ADC000 
  Create folders Split_0, Split_1
  Each dump rename to 01_01.dump 
  And put in folders Split_0, Split_1 with FE/Chip.txt
  For each folder use this model
  Save Disk0.image and Disk1.image
  Join by Dump Disk0.image and Disk1.image to Final.image
  MBR/FAT missing, need rebuild
  Checkdirs ok
  IE->FAT32->Scan or use any favourite software

Monolith USB_130 45 3c 98 b3 1x1

Layout
  CBM2098 1144 Xor eebb_128
Mix
  Input
    Order  0
  Software Bad Bytes
    Block  128
    Group  1
  Block Pair
    Block  0xc00000
    Page   0x4000
Assembler
  Virtual Translator
    Block Size  0x1800000
Comments
  by Bolo
  SBB: Auto ff
  Run Auto_Slow
  Wait while it finish with block 0
  And stop it
  If MBR, NTFS found Run Auto_Fast

Monolith USB_131 ec 1e d9 3f 1x1

Layout
  CBM2098 1127 Xor c32e_64
Mix
  Input
    Order  0
  Software Bad Bytes
    Block  128
    Group  1
Assembler
  Virtual Translator
    Block Size  0x400000
    Image Cut   0x102000
Comments
  Serg for forum 12784

Monolith USB_132 98 3a 98 a3 1x4

Layout
  PS2251-V 1137_1129 Xor 0561_384_256
Mix
  Input
    Order  0/1/2/3
  Block Pair
    Block  0x600000
    Page   0x4000
  Join by Page
    Parts  2
    Page   0x8000
  Join by Dump
    Parts  2
  Block Renum
    Block  0x1800000
    Page   0x4000
Assembler
  Block Number
    Block Size   0x1800000
    Bank Space   0x4000
    Banks        00 / 0x000 / 0xfff
  Actions
    Scan
Comments
  by Bolo
  Check conflicts
  Model works slow due Block Renum but this make all files correct (without they
 are bad).
  Due this better Save Image and use Image Explorer to extract Root
  Perfect Recovery

Monolith USB_133 ad 5c 28 ba 1x1

Layout
  SM3257_41 1148_27 Xor 17fe_0x480
Mix
  Input
    Order  0
  Block Pair
    Block  0x900000
    Page   0x2000
  Block Pair
    Block  0x1200000
    Page   0x4000
Assembler
  Block Number
    Block Size      0x2400000
    Banks           0..3 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  Serg for forum 12855

Monolith USB_135 ec d5 84 72 1x1

Layout
  AU6990 1070 Xor 6771_128
Mix
  Input
    Order  0
Assembler
  Block Number
    Block Size   0x100000
    Bank Space   0x800
  Actions
    Scan
    Find Bank Size
Comments
  by Arvika
  check conflicts

Monolith USB_136 45 3e 98 b3 1x1

Layout
  DM 1144_1152 v2 Xor e88a_256
Mix
  Input
    Order  0
  Software Bad Bytes
    Block  384
    Group  2
Assembler
  Sector Number Slow
    Sector Size     0x4000
Comments
  Serg for forum 12866

Monolith USB_137 89 c4 08 32 1x1

Layout
  SM3280 32_1150_32 Xor 17fe_0x900
Mix
  Input
    Order  0
Assembler
  Sector Number Slow
    Sector Size     0x1000
Comments
  Serg for forum 12885

Monolith USB_138 2c 2c d3 1c 1x1

Layout
  SM3259_41 1150_31 Xor 17fe_256
Mix
  Input
    Order  0
Assembler
  Block Number
    Block Size   0x4800000
    Banks        00 / 0x000 / 0x03f
Comments
  by Bolo & Serg
  Check Conflicts, Perfect Recovery !
  Need to use special adapter to read device at LOW Voltage
  Need adjust Bank Sizes

Monolith USB_139 45 3c a9 a2 1x1

Layout
  20-82-00515-5 14_2048_230 Xor C634_8I
Mix
  Input
    Order  0
  Block Pair
    Block  0x300000
    Page   0x2000
  Block Pair
    Block  0x600000
    Page   0x4000
  Block Pair
    Block  0x43c800000
    Page   0x8000
Assembler
  Sector Number Slow
    Sector Size     0x1000
Comments
  by Arvika
  Statistics:
  RAW scan on RAW image with mix: 35% good pdf files
  RAW scan on disk.image: find nothing due to Bitlocker encryption
  Partition with bitlocker files was good

Monolith USB_140 32 2c c3 08 1x1

Layout
  SM3281_BN 32_1150 Xor 17fe bb
Mix
  Input
    Order  0
  Software Bad Bytes
    Block  3456
    Group  4
  Block Pair
    Block  0x3600000
    Page   0x4000
  Block Pair
    Block  0x6c00000
    Page   0x8000
Assembler
  Block Number
    Block Size   0xd800000
    Bank Space   0x4000
  Actions
    Scan
Comments
  By JeremyB
  First boot NAND chip with VccQ = 1.8v then boot Vcc with 3.3v from reader
  Adjust VccQ as needed, I used 2.04v and got 100% read
  This is a NV-DDR3 chip, Full ID is 32 2c c3 08 32 e6
  Case used FFFF for BB but you must manually mark FF's, You can't use Auto FF
  Use Chip.txt below.
  
  Chip.txt:
  
  // Chip
  Company      Micron
  Name         MT29F512G08EBLCE3W
  ID code      32 2c c3 08
  
  // Structure
  Bus          8
  Banks        1 x 64GB
  Page         18592
  Block        0x3d47000
  Blocks       0x548
  
  // Read
  Cmd          05_E0
  Col          2
  Row          3
  DDR          true
  
  // Special
  Skip_Mask_1  0xfff
  Skip_Page_1  0xd80

上一篇：USB part4
下一篇：返回列表

站内搜索

联系我们