CF or SD Card Recov...
 
Notifications
Clear all

CF or SD Card Recovery?

10 Posts
5 Users
0 Likes
805 Views
Vesalius
(@vesalius)
Posts: 66
Estimable Member
Topic starter
 

So my question isn't weather to recover one of those, but if it is possible to know if either one of those memory storage devices have been recovered before?

 
Posted : 05/12/2016 11:54 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

So my question isn't weather to recover one of those, but if it is possible to know if either one of those memory storage devices have been recovered before?

What do you mean? ?

Any "mass storage device" is "recovered" each single time you read successfully a single byte from it. 😯

In most cases you simply copy the whole extents from the device to another media (clone or image) and then proceed to recover data from the latter.
The original device is not altered in any way, and once all the data has been actually (hopefully) recovered, it is usually wiped and re-tested/re-partitioned/re-formatted, so it is exactly like "new".

For minor corruption problems the recovery consists usually in "fixing" a few values in the partitioning or file systems structure, where "fixing" means making them as they should be (and how they would have been before) so again no way to determine if the device was "recovered".

jaclaz

 
Posted : 05/12/2016 3:09 pm
Vesalius
(@vesalius)
Posts: 66
Estimable Member
Topic starter
 

Any "mass storage device" is "recovered" each single time you read successfully a single byte from it. 😯
jaclaz

So basically, say I give you some sort of memory card, whether it be a CF or SD card. When you return it to me, I would like to know if that specific card has been recovered in anyway, to see if you've tried to recover content from that drive. )

 
Posted : 05/12/2016 3:38 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

So basically, say I give you some sort of memory card, whether it be a CF or SD card. When you return it to me, I would like to know if that specific card has been recovered in anyway, to see if you've tried to recover content from that drive. )

You can use a crystal ball or tarots for that (I-Ching is not accurate enough).

There is nothing in "recovery" that is different from normal, everyday, "reading" the data.

Imagine that instead of a CF or a SD card you give me a book.
How would you understand if I have read it or not, once I return it to you?

jaclaz

 
Posted : 05/12/2016 4:21 pm
Bolo
 Bolo
(@bolo)
Posts: 97
Trusted Member
 

Recovery from SD cards - especially monolith are completely different that recovering data from USB sticks or from phones ! So basically answer is YES - you will know if somebody attempt recovery - just not misunderstood with "reading/creating image". There are different type of damage logical and physical… logical if somebody corrupted data but device it's recognised and physical if device are not recognised in system or recognised with 0 bytes which means that controller which is in SD are damage or more common that firmware in it is corrupted. So basically - If somebody attempt physical recovery of it then you will see it 😉

Why is this totally different ? While in smartphones you can use "solder less" solutions (JIGs for JTAG, ISP eMMC) which will allows to access memory where available and not cause any changes to PCB then when working with monoliths SD cards or microSD cards on physical layer you need to remove coating - then you can use special SD adapter if available or solder around 12 lines in case 8bit NAND protocol to over 21 lines if 16bit communication. So after this your card will looks as on photo + additional solder which left after soldering attempt.

 
Posted : 05/12/2016 10:50 pm
(@vootz)
Posts: 27
Eminent Member
 

If the SD card was write-blocked (such as in a SD Card Adapter via USB), I wouldn't think there is anyway a user could tell that data was imaged/extracted, or even looked at for that matter.

 
Posted : 05/12/2016 11:15 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

So basically - If somebody attempt physical recovery of it then you will see it 😉

Sure ) , and the device won't likely be anymore usable (and it would make very little sense to return an opened up/etched/sanded down device with a few blobs of half-@§§ed soldering on it and pretend that no recovery attempt was performed).

jaclaz

 
Posted : 06/12/2016 12:25 am
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

To make it short, there is no way to detect from the card itself if it was read for regular usage, or it was read for "recovery".

 
Posted : 06/12/2016 2:44 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

To make it short, there is no way to detect from the card itself if it was read for regular usage, or it was read for "recovery".

We can go even a little bit further, there is additionally no particular way to detect if it has been read at all, if not in particular cases.

jaclaz

 
Posted : 06/12/2016 7:16 pm
Vesalius
(@vesalius)
Posts: 66
Estimable Member
Topic starter
 

Cheers guys,

Love the comments and debate's you guys create here.

I will definitely be around more to ask you lot for more annoying questions D

 
Posted : 07/12/2016 11:47 am
Share: