I am trying to view a Micro SD Card. It will not appear as a viewable device on my computer. Tableau Disk Monitor, FTK Imager, EnCase (6.19), and Windows Explorer will not "see" it. The reader is fine, as other Micro SD Cards are "seen".
The computer slows to almost unresponsive and the best I could get from it was "I/O Error" when attempting to view the card. Normally I would consider this a "bad" card, but there are two that are acting like this and I am suspicious that there may be encryption in use.
Not knowing much about encryption other than how to spell it, I am reaching out for some advice, would an encrypted card act this way? What are some options to rule encryption out?
I have another card from this same case which is seen and imaged, but as 0x00 from sector 0 to the end… again I am suspicious. If a card is encrypted and imaged, could this be a result. I imaged this last card using both FTK Imager and EnCase with the same results..
I expect that your card reader is at fault. Your reader may not read SDHC cards.
If it came from a mobile handset; try inserting the SD card back into the original handset and see if you can view and image it as USB storage device. If it genuinely is encrypted - you may need to verify this, and try and brute force the password using something like Mantech Crowbar.
The reader is fine, as other Micro SD Cards are "seen".
It may be … and it may not be. For example, is the particular type of micro-SD supported by a) your reader, and b) your software? If the card is latest SDXC, it can't be read in an early SDSC-reader.
Start by ensuring that the card type is 'lower' than the reader type.
Not knowing much about encryption other than how to spell it, I am reaching out for some advice, would an encrypted card act this way?
I would not expect it to I'd expect a straight message that the card is encrypted, and either that it can'y be read, or a prompt for the secret code. Encryption of these cards are not usual – if it's a phone card, it may be encrypted, but if it has been used as a general 'add-on memory' in a MP3 player or similar device, I would not expect it.
I would expect encryption to leave the data looking garbled, but always visible with a sector viewer.
I think your problem is hardware related. Being three chips, I would look at the reader/compatibility first.
Thanks for all the replies… looking forward to getting a new Micro SD Card reader since as I recall the cards I couldn't access were larger than 2GB making the possibility of it being a reader issue quite likely. From what I've read since reading your replies, Micro SD Cards Larger than 2GB are SDHC and require specific readers. Mine must be an older reader…. I'll find out in a few days and report back here.
Ok, the cards that could not be read were a 64MB and a 1GB card which could not be read, by two separate machines now.
The card which reported 0x00 is a 32MB card. FTK imager sees 31,344KB but all 0x00…
So I have yet to purchase a second card reader, but will ASAP. But this sorta rules of the thought that it is a SCHD issue. I did create a tyuecrypt volume on a thumbdrive I have laying around and viewed it and, as reported above, I could see all sectors, just garbled… so unless other encryption utilities can make a drive unreadable without the compatible encryption I am wondering if it's not a bad SD Card…
For the 32MB card, who "wipes" a card? They come preformated don't they? Wiping utilities are not something I would expect to commonly find in use by most people, unless they were tech savy and rather security concious..
What are your thoughts?
Cards do die. In those cases the solution is to remove (unsolder) the flash memory and read it in a separate reader. Not a trival task.
A full format (not quick) will fill a card with zeros, but will also have basic file system infomation at the start.
Try a new card reader, and then think again.
These are micro SD Cards, so no unsoldering of any chips for me, not that I could anyway. However, I think I got the solution.
After trying a new card reader with no luck. Trying Caine (linux) with no luck and even a Mac, still no luck I took a close look at the three cards in question under a strong magnifying glass. The one thing in common with the three cards that do not work vs all the other cards that do, is physical damage. One or more cracks on the cards along with what appears to be a sticker partially peeled back exposing some "contact" looking areas underneath.
I'm going with broken cards… what says you?
