“USBC” string in su...
 
Notifications
Clear all

“USBC” string in superblock of memory cards (FAT32; exFAT)

Heracleides
(@heracleides)
New Member

Side note: I found this thread from eleven years ago about this topic, but because I am unsure whether "necroposting" is acceptable here, I am posting a new thread. I see nothing wrong with it, but from my experience of posting in long inactive threads on several other online forums, I received hostile responses.  Therefore I am going the safe way here. Thanks for understanding.

Also, I am using a more descriptive thread title than “FAT32 strangeness”.


This phenomenon is fairly undocumented online, beyond few posts. It also happened to me three times or more. Two of those times were:

1. After using an USB hub adapter on my smartphone. The adapter is able to simulate a docking station to allow for simultaneous power input, but the feature was deactivated. Possibly lead to undervoltage brown-out, as the power source is a mobile phone battery.

The FAT32 superblock on a 32GB SDHC memory card moved from LBA 8192 to 8193! LBA 8192 was occupied by "USBC". The block started with that string and the rest of the block was only null bytes. I easily fixed it in a HEX editor, which I used to examined the file system.

2. After a bogus card reader disconnected and re-connected during a file move. This time, it was a 64GB exFAT MicroSD card.

Three blocks were overwritten this time.

The superblock was overwritten with USBC and gibberish after it (previous case: nothing after "USBC"), and not moved. Backup superblock thankfully allowed recovery.

One sector which contained the bitmap of free clusters (the part that FAT32 does not have, as the cluster allocation table overtook this functionality) was overwritten with USBC and few file names! This means that something from a directoy structure was written there! Strange glitch.

Another "USBC" block was on the original part in the actual directory structure, around the location in the structure where the file reference of the file transferred at that time was.

Trying to open that directory in a file manager causes a "corrupted" telling it is corrupted.

 

 

 

Quote
Topic starter Posted : 18/05/2021 1:09 am
thefuf
(@thefuf)
Active Member
Posted by: @heracleides

Side note: I found this thread from eleven years ago about this topic, but because I am unsure whether "necroposting" is acceptable here, I am posting a new thread. I see nothing wrong with it, but from my experience of posting in long inactive threads on several other online forums, I received hostile responses.  Therefore I am going the safe way here. Thanks for understanding.

Also, I am using a more descriptive thread title than “FAT32 strangeness”.


This phenomenon is fairly undocumented online, beyond few posts. It also happened to me three times or more. Two of those times were:

1. After using an USB hub adapter on my smartphone. The adapter is able to simulate a docking station to allow for simultaneous power input, but the feature was deactivated. Possibly lead to undervoltage brown-out, as the power source is a mobile phone battery.

The FAT32 superblock on a 32GB SDHC memory card moved from LBA 8192 to 8193! LBA 8192 was occupied by "USBC". The block started with that string and the rest of the block was only null bytes. I easily fixed it in a HEX editor, which I used to examined the file system.

2. After a bogus card reader disconnected and re-connected during a file move. This time, it was a 64GB exFAT MicroSD card.

Three blocks were overwritten this time.

The superblock was overwritten with USBC and gibberish after it (previous case: nothing after "USBC"), and not moved. Backup superblock thankfully allowed recovery.

One sector which contained the bitmap of free clusters (the part that FAT32 does not have, as the cluster allocation table overtook this functionality) was overwritten with USBC and few file names! This means that something from a directoy structure was written there! Strange glitch.

Another "USBC" block was on the original part in the actual directory structure, around the location in the structure where the file reference of the file transferred at that time was.

Trying to open that directory in a file manager causes a "corrupted" telling it is corrupted.

 

 

 

It's documented here: https://digitalcorpora.org/corpora/disk-images/nps-2014-usb-nondeterministic (it's better to read the PDF file there, since the proper formatting is gone)

This post was modified 4 weeks ago by thefuf
ReplyQuote
Posted : 18/05/2021 9:46 am
Share: