CF or SD Card Recov...
 
Notifications
Clear all

CF or SD Card Recovery?

10 Posts
5 Users
0 Reactions
1,286 Views
Vesalius
(@vesalius)
Estimable Member
Joined: 9 years ago
Posts: 66
Topic starter  

So my question isn't weather to recover one of those, but if it is possible to know if either one of those memory storage devices have been recovered before?


   
Quote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

So my question isn't weather to recover one of those, but if it is possible to know if either one of those memory storage devices have been recovered before?

What do you mean? ?

Any "mass storage device" is "recovered" each single time you read successfully a single byte from it. 😯

In most cases you simply copy the whole extents from the device to another media (clone or image) and then proceed to recover data from the latter.
The original device is not altered in any way, and once all the data has been actually (hopefully) recovered, it is usually wiped and re-tested/re-partitioned/re-formatted, so it is exactly like "new".

For minor corruption problems the recovery consists usually in "fixing" a few values in the partitioning or file systems structure, where "fixing" means making them as they should be (and how they would have been before) so again no way to determine if the device was "recovered".

jaclaz


   
ReplyQuote
Vesalius
(@vesalius)
Estimable Member
Joined: 9 years ago
Posts: 66
Topic starter  

Any "mass storage device" is "recovered" each single time you read successfully a single byte from it. 😯
jaclaz

So basically, say I give you some sort of memory card, whether it be a CF or SD card. When you return it to me, I would like to know if that specific card has been recovered in anyway, to see if you've tried to recover content from that drive. )


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

So basically, say I give you some sort of memory card, whether it be a CF or SD card. When you return it to me, I would like to know if that specific card has been recovered in anyway, to see if you've tried to recover content from that drive. )

You can use a crystal ball or tarots for that (I-Ching is not accurate enough).

There is nothing in "recovery" that is different from normal, everyday, "reading" the data.

Imagine that instead of a CF or a SD card you give me a book.
How would you understand if I have read it or not, once I return it to you?

jaclaz


   
ReplyQuote
Bolo
 Bolo
(@bolo)
Trusted Member
Joined: 9 years ago
Posts: 97
 

Recovery from SD cards - especially monolith are completely different that recovering data from USB sticks or from phones ! So basically answer is YES - you will know if somebody attempt recovery - just not misunderstood with "reading/creating image". There are different type of damage logical and physical… logical if somebody corrupted data but device it's recognised and physical if device are not recognised in system or recognised with 0 bytes which means that controller which is in SD are damage or more common that firmware in it is corrupted. So basically - If somebody attempt physical recovery of it then you will see it 😉

Why is this totally different ? While in smartphones you can use "solder less" solutions (JIGs for JTAG, ISP eMMC) which will allows to access memory where available and not cause any changes to PCB then when working with monoliths SD cards or microSD cards on physical layer you need to remove coating - then you can use special SD adapter if available or solder around 12 lines in case 8bit NAND protocol to over 21 lines if 16bit communication. So after this your card will looks as on photo + additional solder which left after soldering attempt.


   
ReplyQuote
(@vootz)
Eminent Member
Joined: 20 years ago
Posts: 27
 

If the SD card was write-blocked (such as in a SD Card Adapter via USB), I wouldn't think there is anyway a user could tell that data was imaged/extracted, or even looked at for that matter.


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

So basically - If somebody attempt physical recovery of it then you will see it 😉

Sure ) , and the device won't likely be anymore usable (and it would make very little sense to return an opened up/etched/sanded down device with a few blobs of half-@§§ed soldering on it and pretend that no recovery attempt was performed).

jaclaz


   
ReplyQuote
passcodeunlock
(@passcodeunlock)
Prominent Member
Joined: 9 years ago
Posts: 792
 

To make it short, there is no way to detect from the card itself if it was read for regular usage, or it was read for "recovery".


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

To make it short, there is no way to detect from the card itself if it was read for regular usage, or it was read for "recovery".

We can go even a little bit further, there is additionally no particular way to detect if it has been read at all, if not in particular cases.

jaclaz


   
ReplyQuote
Vesalius
(@vesalius)
Estimable Member
Joined: 9 years ago
Posts: 66
Topic starter  

Cheers guys,

Love the comments and debate's you guys create here.

I will definitely be around more to ask you lot for more annoying questions D


   
ReplyQuote
Share: