±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35875
New Yesterday: 3 Visitors: 175

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

FAT32 strangeness

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3  Next 
  

Fab4
Senior Member
 

Re: FAT32 strangeness

Post Posted: Oct 14, 09 12:36

- jaclaz


As said in the other thread, post the Vid/Pid of the device and/or check it with Chipgenius or CheckUdisk, from the actual Controller Maker/Part Number it is maybe possible to completely exclude the wear-leveling hypothesis.

jaclaz


Thanks for your additional thoughts. I have not researched wear-levelling before so this is a great heads up. I will absolutely check it out with Chipgenius or other to establish whether wear-levelling is even a possibility. The manufacturer is PQI which I recall was mentioned in relation to wear-levelling in the thread you kindly referred me to.

- mscotgrove
I don't think wear leveling would give this symptom. It might point you to an incorrect sector, but not different data in the correct sector.


I don't know enough about the subject yet to accept this as read but it will most certainly be borne in mind as something for verification during my own research - thanks.

- Wardy
Can I have the make of the USB key and possibly model number? I'd like to purchase one and conduct some studies into this reported behaviour.


As stated above, it's definitely a PQI. When I back in the lab tomorrow I will post the model number. Perhaps you would kindly post a summary of your findings when you get around to it.

Thanks guys.  
 
  

Fab4
Senior Member
 

Re: FAT32 strangeness

Post Posted: Oct 15, 09 15:29

Right then;

pqi Traveling Disk U172P

Extract of CheckUdisk output;

VID&PID: Vid_3538&Pid_0070
Speed: high speed

VendorID: Generic
ProductID: USB Flash Disk
Product Revision: 8.07

Vendor Description: PQI
Product Description: USB Flash drive

Wear-leveling is definitely a technology pqi deploy on some 2.5" drives but I cannot see it noted in relation to USB drives in their corporate blurb.  
 
  

jaclaz
Senior Member
 

Re: FAT32 strangeness

Post Posted: Oct 15, 09 20:01

Well, you won't find the data on the PQI site.
flashboot.ru/iflash.html
PQI Traveling PQI traveling i270 16 Gb 3538 0070 Alcor AU6983 AlcorMP(081208)


The used chip is Alcor:
flashboot.ru/index.php...t&id=7

It seems like ther is not a page for the AU6983, there is one for AU6981 and one for 6984:
www.alcormicro.com/con...;IndexID=2
www.alcormicro.com/con...;IndexID=3
It is probable that AU6983 is similar to the AU6984

jaclaz  
 
  

Fab4
Senior Member
 

Re: FAT32 strangeness

Post Posted: Oct 15, 09 20:47

- jaclaz
Well, you won't find the data on the PQI site.


Wasn't expecting that to be taken as that the pqi corporate pages were going to be the extent of my research Laughing

Just another busy day with deadlines meaning that I didn't have any more time this morning than to simply post the detail that others had asked for.

Thanks for the pointer to the site. I don't think you've posted the closest entry, rather I think that this is it;


PQI U173 8 Gb 3538 0070 6986 – AlcorMP(081208)


So I think its the Alcor 6986 which is of interest.

AU6986  
 
  

jaclaz
Senior Member
 

Re: FAT32 strangeness

Post Posted: Oct 15, 09 22:03

Whatever.
84 seems to me nearer to 83 than 86, but the good thing in opinions is that they are free, both as in freedom as in free beer. Wink

Anyway all have "bad block management" (which may mean also some form of wear leveling) and ECC correction (whatever it is) and that may be part of the cause.

jaclaz  
 
  

thefuf
Senior Member
 

Re: FAT32 strangeness

Post Posted: Oct 15, 09 22:19

Read these papers:
www.dataio.com/pdf/NAN...hanism.pdf
www.snia.org/events/st...ndows7.pdf

Unfortunately, I didn't found a complete answer for the wear-leveling question.  
 
  

Fab4
Senior Member
 

Re: FAT32 strangeness

Post Posted: Oct 16, 09 03:46

- jaclaz

84 seems to me nearer to 83 than 86


Let me explain - the CheckUdisk output I posted earlier was only an extract. You kindly sought out an entry for PQI Traveling PQI traveling i270 16 Gb with the correct Pid/Vid. I'm stating that the entry for PQI U173 8 Gb is a closer match to my usb drive model, also with correct Pid/Vid and that entry states Alcor 6986. I'm not attempting to convince you about any ill-formed maths!

I think we're agreeing that wear-leveling cannot be ruled out in this case and I need to investigate/test further.  
 

Page 2 of 3
Page Previous  1, 2, 3  Next