1. 你的位置
  2. 网站首页
  3. 常见问题
  4. 使用教程
  5. FE资源模型

FC1178主控芯片如何成功提取数据？

2024-02-26 14:48:47 168

F1178 BC1   2c 84 58 32   1x1   

Layout
  FC1178 1154_1150 Xor 21cd_128
Mix
  Input
    Order  0
Assembler
  Virtual Translator
    Block Size  0x200000
    Image Cut   0x1f6000
Comments
  Serg for forum 10914
  Strane case
  But VT was successful

FC1178 AA3   89 a4 64 32   1x1  
司法鉴定，质量鉴定, 电子数据，声像资料GdBflash extractor
  
Layout
  FC1178 1154_1150 Xor 0f45_128
Mix
  Input
    Order  0
  Divide
    Field  Block Number
    Value  0x400
  Add
    Field  Block Number
    Value  0x3
Assembler
  Block Number
    Block Size   0x1000000
    Bank Space   0x4000
    Banks        00 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  Serg for forum 11716
  
  May be need Add bigger value to BN
  
  MBR, FAT not found
  
  Check Dirs OK
  Files OK
  But some folders missing
  
  11.04.2022 Divide changed
  

  

 

FC1178   2c c4 08 32   1x1   Ref  

司法鉴定，质量鉴定, 电子数据，声像资料

GdBflash extractor


  

Layout
  FC1178 1150_1146
Mix
  Input
    Order  0
  Software Bad Bytes
    Block  2304
    Group  2
  Block Cut
    Block  0x3000/0x1000
  Xor 21cd
    Page   0x3000
    Group  4
Assembler
  Raw
    Block Size  0x20000
Comments
  by Arvika & Serg for forum 12586
  device is refurbished
  Flash use 12 sectors
  Need cut ~5000 bytes with SBB in the middle of page - manual job
  Raw Recovery Test show 87 good, 65 broken jpegs
  Use RAW recovery or add after Xor 21cd step:
     Divide
       Field  Block Number
       Value  0x900
   Assembler
     Block Number
       Block Size   0x1b00000
       Bank Space   0x4000
       Banks        00 / 0x000 / 0x1ff

FC1178   45 3c 98 b3   1x1   
Layout
  FC1178 1148_1144
Mix
  Input
    Order  0
  Xor 21cd
    Page   0x4000
    Group  4
  Divide
    Field  Block Number
    Value  0x2ee
  Add
    Field  Block Number
    Value  0x35
  Block Cut
    Block  0/0x24000/0xBB8000/0x24000
Assembler
  Block Number
    Block Size   0xbb8000
    Bank Space   0x4000
    Image Cut    0x0/0x26d18000/0xd3c000
    Banks        00 / 0x000 / 0x4b5
  Actions
    Scan
    Find Bank Size
Comments
  by Arvika
  ID: 45 3c 98 b3 76 72
  Need remove bad bits to use this model (if exist)
  Use Split by block: 0xd6e000
  Each dump rename to 01_01.dump 
  And put in folders Split_0, Split_1 
  For each folder: copy here FE folder
  For Split_0 use above model and save as Disk0.image
  For Split_1 use model:
  Layout
    FC1178 1148_1144
  Mix
    Input
      Order  0
    Xor 21cd
      Page   0x4000
      Group  4
    Divide
      Field  Block Number
      Value  0x2eb
    Block Cut
      Block  0/0x2a000/0xBAC000/0x2a000
  Assembler
    Block Number
      Block Size   0xbac000
      Bank Space   0x4000
      Image Cut    0xd42000
      Banks        00 / 0x000 / 0x53f
    Save as Disk1.image
    Join by dump Disk0.image and Disk1.image->Final.image
    No MBR, no FAT
    Run scan on Final.image by any software
    RAW scan solution give pdf size detected (3662)
    LBN scan solution give pdf size detected (4258)
    Check dirs was ok, files ok, strucutre ok
    After additional work possible rebuild full file system
 

 

FC1178   ad de 14 a7   1x1  
司法鉴定，质量鉴定, 电子数据，声像资料GdBflash extractor
  
Layout
  FC1178 1130_1126
Mix
  Input
    Order  0
  Xor 21cd
    Page   0x4000
    Group  4
  Divide
    Field  Block Number
    Value  0xfa
  Block Cut
    Block  0/0x18000/0x3E8000
  Add
    Field  Block Number
    Value  0x4
Assembler
  Block Number
    Block Size   0x3e8000
    Bank Space   0x4000
    Image Cut    0x3a9800
    Banks        00 / 0x000 / 0x3be
  Actions
    Scan
Comments
  by Arvika
  first need remove bad bits to use this model
  even blocks empty, odd with data
  save disk.image, scan by any software
  Check dirs ok
  Possible rebuild full structure after additional work
  Solution could be other if even and odd blocks have data
  

  

 

FC1178   ad de 14 a7   1x1   Ref  
司法鉴定，质量鉴定, 电子数据，声像资料GdBflash extractor
  
Layout
  FC1178 1130_1126
Mix
  Input
    Order  0
  Xor 21cd
    Page   0x4000
    Group  4
  Divide
    Field  Block Number
    Value  0xff
  Block Cut
    Block  0x3E4000/0x4000/0x18000/0
  Add
    Field  Block Number
    Value  0x4
Assembler
  Block Number
    Block Size   0x3fc000
    Bank Space   0x4000
    Banks        00 / 0x000 / 0x3c4
  Actions
    Scan
Comments
  Model can help to solve future FC cases by your own
  Need find empty pages that will need to be removed to adjust Block Cut
  Based on removed pages adjust Divide Block Number parametr and Block size in A
ssembler
  Use RAW Scan or Save Image and use any other software. 92% of files are OK
  by Bolo
  

 
 

 

  

 
西数科技: 司法鉴定/产品质量鉴定/检验检测/数据恢复专家. 4006184118

常见问题解答

FC1178主控芯片在数据恢复中有什么特殊作用？

FC1178是文章中提到的存储主控芯片型号，常用于U盘等存储设备。在电子取证和司法鉴定场景中，针对该主控的闪存布局（如1154_1150）和Xor算法（如21cd_128Mix）进行逆向分析，可以绕过硬件限制，直接读取原始数据。文章案例显示，即使遇到异常情况（如Strane case），通过虚拟转换器（Virtual Translator）和块大小调整（0x200000）也能成功完成数据提取。

如何解读FC1178的Xor参数和块大小设置？

文章中的Xor参数（如21cd_128Mix或0f45_128Mix）是用于解密闪存数据的关键密钥，而块大小（0x200000或0x1000000）定义了数据读取的粒度。实际操作中，需根据芯片的物理布局（如Bank Space 0x4000）和字段偏移（Divide Field Block Number Value 0x400）进行匹配。这些参数通常从芯片ID（如2c 84 58 32）或固件日志中获取，错误设置会导致数据乱码。

FC1178案例中提到的'Assembler'和'Scan'操作是什么？

Assembler（汇编器）是指将分散的闪存块按逻辑顺序重组为完整镜像的过程，文章中通过设置Bank Space和块号偏移（Add Field Block Number Value 0x3）来实现。Scan（扫描）则是自动检测正确参数的过程，如案例中Actions Scan功能，它会尝试不同组合（如Banks 00/0x000/0x7ff）以找到可用的数据排列。这两个步骤是FC1178数据恢复流程的核心，尤其适用于未知固件版本或损坏的存储设备。

首页
产品
鉴定
联系