Wiped SSD Size v Ma...
 
Notifications
Clear all

Wiped SSD Size v Manufacturer Size

6 Posts
3 Users
0 Likes
3,565 Views
fbrackin
(@fbrackin)
Posts: 10
Active Member
Topic starter
 

I have a SK Hynix 256GB M.2 SSD NVMe PCIe drive that I believed to has been wiped. It was imaged using FTK and when I open it in X-Ways is appears to all unallocated space. When I run a checksum against it I get zeros as expected my problem is just that the size that X-Ways says it is (238 GB or 256,060,514,304 bytes, which is the 256 GB's) does not match the manufacturer size of 256 GB. I think there is an easy reason for this but I'm having a brain fart (if I can say that here) and am not sure why. Thanks for any assistance rendered...

 
Posted : 01/03/2021 9:08 pm
fbrackin
(@fbrackin)
Posts: 10
Active Member
Topic starter
 

The manufacturer size is 256 GB; what I'm really asking is why does X-Ways report the size as "238 GB or 256,060,514,304 bytes"? This seems confusing because 256,060,514,304 bytes is 256 GBs. It's not saying 238 of 256 GB, which would make more sense. I'm trying to determine if I'm looking at the entire drive.

 
Posted : 02/03/2021 1:04 pm
AmNe5iA
(@amne5ia)
Posts: 173
Estimable Member
 

256,060,514,304 B = 256GB according to the manufacturer which divides by 1000 Bytes to reach their figure.

256,060,514,304 B = 238GB according to X-Ways which divides by 1024 Bytes to reach it's figure.

Maybe if you think of X-Ways as stating it is 238GiB it will make things clearer for you.

https://en.wikipedia.org/wiki/Byte#Multiple-byte_units

 

The bigger question to me is, if you had access to X-ways, why did you use FTK Imager to create the disk image?

 
Posted : 02/03/2021 1:28 pm
(@tecleo)
Posts: 8
Active Member
 

Side note: If the NVMe was wiped (or the data deleted?) then the data was more than likely trimmed. One of the few possibilities for recovering some data would be to use a PC3000 in “Factory Access Mode”.

See - Life after Trim: Using Factory Access Mode for Imaging SSD Drives
https://blog.elcomsoft.com/2019/01/life-after-trim-using-factory-access-mode-for-imaging-ssd-drives

This post was modified 3 years ago by Tecleo
 
Posted : 02/03/2021 1:53 pm
fbrackin
(@fbrackin)
Posts: 10
Active Member
Topic starter
 

@amne5ia - Thank you, that is exactly the answer I was looking for but could not remember. Regarding your question it was imaged by someone else.

 
Posted : 02/03/2021 2:27 pm
fbrackin
(@fbrackin)
Posts: 10
Active Member
Topic starter
 

@tecleo - Thanks for your info; very good article and I don't have access to a PC3000 anymore but I will pass that on to the client as an avenue for them to pursue.

 
Posted : 02/03/2021 2:41 pm
Share: