基于Flash Extractor芯片提取方案,受损Nand flash芯片数据分析,主控方案分析,TF一体盘引脚定义分析

Flash Extractor芯片分析电子取证技术2024培训报名,请发报名信息至:wd@wdsos.com
当前位置:首页 > 资源模型 > FC主控 FC主控
FC1178
F1178 BC1   2c 84 58 32   1x1  
Layout
  FC1178 1154_1150 Xor 21cd_128
Mix
  Input
    Order  0
Assembler
  Virtual Translator
    Block Size  0x200000
    Image Cut   0x1f6000
Comments
  Serg for forum 10914
  Strane case
  But VT was successful



FC1178 AA3   89 a4 64 32   1x1  
DF3flash extractor
 
Layout
  FC1178 1154_1150 Xor 0f45_128
Mix
  Input
    Order  0
  Divide
    Field  Block Number
    Value  0x400
  Add
    Field  Block Number
    Value  0x3
Assembler
  Block Number
    Block Size   0x1000000
    Bank Space   0x4000
    Banks        00 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  Serg for forum 11716
  
  May be need Add bigger value to BN
  
  MBR, FAT not found
  
  Check Dirs OK
  Files OK
  But some folders missing
  
  11.04.2022 Divide changed
 
 



 
FC1178   2c c4 08 32   1x1   Ref  
DF3flash extractor
 
Layout
  FC1178 1150_1146
Mix
  Input
    Order  0
  Software Bad Bytes
    Block  2304
    Group  2
  Block Cut
    Block  0x3000/0x1000
  Xor 21cd
    Page   0x3000
    Group  4
Assembler
  Raw
    Block Size  0x20000
Comments
  by Arvika & Serg for forum 12586
  device is refurbished
  Flash use 12 sectors
  Need cut ~5000 bytes with SBB in the middle of page - manual job
  Raw Recovery Test show 87 good, 65 broken jpegs
  Use RAW recovery or add after Xor 21cd step:
     Divide
       Field  Block Number
       Value  0x900
   Assembler
     Block Number
       Block Size   0x1b00000
       Bank Space   0x4000
       Banks        00 / 0x000 / 0x1ff





FC1178   45 3c 98 b3   1x1  
Layout
  FC1178 1148_1144
Mix
  Input
    Order  0
  Xor 21cd
    Page   0x4000
    Group  4
  Divide
    Field  Block Number
    Value  0x2ee
  Add
    Field  Block Number
    Value  0x35
  Block Cut
    Block  0/0x24000/0xBB8000/0x24000
Assembler
  Block Number
    Block Size   0xbb8000
    Bank Space   0x4000
    Image Cut    0x0/0x26d18000/0xd3c000
    Banks        00 / 0x000 / 0x4b5
  Actions
    Scan
    Find Bank Size
Comments
  by Arvika
  ID: 45 3c 98 b3 76 72
  Need remove bad bits to use this model (if exist)
  Use Split by block: 0xd6e000
  Each dump rename to 01_01.dump 
  And put in folders Split_0, Split_1 
  For each folder: copy here FE folder
  For Split_0 use above model and save as Disk0.image
  For Split_1 use model:
  Layout
    FC1178 1148_1144
  Mix
    Input
      Order  0
    Xor 21cd
      Page   0x4000
      Group  4
    Divide
      Field  Block Number
      Value  0x2eb
    Block Cut
      Block  0/0x2a000/0xBAC000/0x2a000
  Assembler
    Block Number
      Block Size   0xbac000
      Bank Space   0x4000
      Image Cut    0xd42000
      Banks        00 / 0x000 / 0x53f
    Save as Disk1.image
    Join by dump Disk0.image and Disk1.image->Final.image
    No MBR, no FAT
    Run scan on Final.image by any software
    RAW scan solution give pdf size detected (3662)
    LBN scan solution give pdf size detected (4258)
    Check dirs was ok, files ok, strucutre ok
    After additional work possible rebuild full file system






 
FC1178   ad de 14 a7   1x1  
DF3flash extractor
 
Layout
  FC1178 1130_1126
Mix
  Input
    Order  0
  Xor 21cd
    Page   0x4000
    Group  4
  Divide
    Field  Block Number
    Value  0xfa
  Block Cut
    Block  0/0x18000/0x3E8000
  Add
    Field  Block Number
    Value  0x4
Assembler
  Block Number
    Block Size   0x3e8000
    Bank Space   0x4000
    Image Cut    0x3a9800
    Banks        00 / 0x000 / 0x3be
  Actions
    Scan
Comments
  by Arvika
  first need remove bad bits to use this model
  even blocks empty, odd with data
  save disk.image, scan by any software
  Check dirs ok
  Possible rebuild full structure after additional work
  Solution could be other if even and odd blocks have data
 
 



 
FC1178   ad de 14 a7   1x1   Ref  
DF3flash extractor
 
Layout
  FC1178 1130_1126
Mix
  Input
    Order  0
  Xor 21cd
    Page   0x4000
    Group  4
  Divide
    Field  Block Number
    Value  0xff
  Block Cut
    Block  0x3E4000/0x4000/0x18000/0
  Add
    Field  Block Number
    Value  0x4
Assembler
  Block Number
    Block Size   0x3fc000
    Bank Space   0x4000
    Banks        00 / 0x000 / 0x3c4
  Actions
    Scan
Comments
  Model can help to solve future FC cases by your own
  Need find empty pages that will need to be removed to adjust Block Cut
  Based on removed pages adjust Divide Block Number parametr and Block size in A
ssembler
  Use RAW Scan or Save Image and use any other software. 92% of files are OK
  by Bolo
 
 
 
 
 

 
上一篇:返回列表
下一篇: FC1179
Copyright(C)2014 西数科技(江苏)有限公司 wdsos.com 备案号:苏ICP备09074223号 苏公网安备:32010202010982号
地址:江苏省南京市玄武区珠江路435号华海大厦6楼601室(同庆楼右侧上电梯) 
地址:江苏省淮安市清江浦区枚皋路中兴软件园研发楼503室 
数据恢复:025-86883952  司法鉴定:13813824669 
|公众号|微博|论坛|百家号|