±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36604
New Yesterday: 3 Visitors: 149

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

How to mount / make forensic software 'see' SSD RAID 0

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3  Next 
  

jaclaz
Senior Member
 

Re: How to mount / make forensic software 'see' SSD RAID 0

Post Posted: Jun 24, 17 19:03

Yes, the NAND chip Toshiba TH58TE69D2HBA89 is 64 Gb, so that there are four of them, it is 256 Gb total arranged as 2x128 in RAID 0.

This should be the actual label:
www.hwmaster.com/wp-co.../Label.jpg

It seems like there is no third party adapter for those. Sad

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

einstein9
Member
 

Re: How to mount / make forensic software 'see' SSD RAID 0

Post Posted: Jul 06, 17 19:55

You have 2 options here:

1- create Full 2 RAW dumps of both ans assemble the RAID0 outside later with any 3rd-party App. like r-studio for example or winhex.

everytime you need something from it you have to re-assemble it again

2- Assemble the RAID0 with R-studio for example and once its done, you may EXPORT the FULL image and use it with any forensic tool later.

i`ll go for option-2

good luck  
 
  

jaclaz
Senior Member
 

Re: How to mount / make forensic software 'see' SSD RAID 0

Post Posted: Jul 06, 17 21:39

- einstein9

1- create Full 2 RAW dumps of both ans assemble the RAID0 outside later with any 3rd-party App. like r-studio for example or winhex.


The issue here is seemingly that only one dump of "one side" is possible without a special adapter/a modified one. Confused

It has to be seen if it is possible to re-mount the card in the original laptop and boot the laptop to a "forensic safe" OS to make the dump on the running machine.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

JaredDM
Senior Member
 

Re: How to mount / make forensic software 'see' SSD RAID 0

Post Posted: Jul 06, 17 23:21

I've yet to actually get one of these in for data recovery, but I have talked with other labs that have. Basically what this is, is two SSD's built onto a single PCB. One is on the front side, and one is on the back side.

The issue is, that most mSATA ports/adapters are only equipped to read one set, and usually with the pins touching just from one side. So whatever adapter you're putting it into is only reading one side of the SSD, but not reading the other SSD. So to read the other side you'll need to either find an adapter which has the pins touching on the opposite side, or manually wire into the SATA channels (just four wires) then plug it in to provide power.
_________________
Lead Data Recovery Tech at Data Medics® - www.data-medics.com 
 
  

jaclaz
Senior Member
 

Re: How to mount / make forensic software 'see' SSD RAID 0

Post Posted: Jul 06, 17 23:37

- JaredDM
I've yet to actually get one of these in for data recovery, but I have talked with other labs that have. Basically what this is, is two SSD's built onto a single PCB. One is on the front side, and one is on the back side.

The issue is, that most mSATA ports/adapters are only equipped to read one set, and usually with the pins touching just from one side. So whatever adapter you're putting it into is only reading one side of the SSD, but not reading the other SSD. So to read the other side you'll need to either find an adapter which has the pins touching on the opposite side, or manually wire into the SATA channels (just four wires) then plug it in to provide power.

Sure and C.R.S. already posted a (possible/probable) pinout:
www.forensicfocus.com/...8/#6589148

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

JaredDM
Senior Member
 

Re: How to mount / make forensic software 'see' SSD RAID 0

Post Posted: Jul 07, 17 02:43

- jaclaz

Sure and C.R.S. already posted a (possible/probable) pinout:
www.forensicfocus.com/...8/#6589148

jaclaz


Yes, you're right, I guess I didn't read his full post. But based on the circuitry I'm seeing, I don't think he's got the pins quite right. I'm pretty sure this is the correct pin designations for Acer's proprietary side:



He had the right pins, but RX and TX I believe were crossed.
_________________
Lead Data Recovery Tech at Data Medics® - www.data-medics.com 
 
  

jaclaz
Senior Member
 

Re: How to mount / make forensic software 'see' SSD RAID 0

Post Posted: Jul 07, 17 12:26

- JaredDM


He had the right pins, but RX and TX I believe were crossed.

Possibly, or possibly not, generally speaking I believe there are few things as misnamed (between Tx and Rx) than serial communication pinouts, depending on convention used or simply the whim of the writer of the docs.
Anyway it is a nice confirmation Smile and at the most it is a matter of exchanging TX with Rx.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 

Page 2 of 3
Page Previous  1, 2, 3  Next