SD卡数据恢复如何用Monolith SD_5提取？
| Monolith SD_5 98 3a 98 a3 1x2 |
Layout
SD_20 v2 1148_1142
Mix
Input
Order 0/1
Xor 5061
Block 0x600000
Page 0x4000
Module 256
BP Trash false
Block Pair
Block 0x600000
Page 0x4000
Join by Dump
Parts 2
Assembler
Block Number
Block Size 0xc00000
Bank Space 0x4000
Banks 00 / 0x000 / 0x6ff
Actions
Scan
Comments
by Arvika
RAW recovery
| Monolith SD_5 98 3a a4 93 1x2 |
Layout
PS8210 1106_1102 Xor 0561_256 v2
Mix
Input
Order 0/1
Join by Page
Parts 2
Page 0x200
Block Pair
Block 0x800000
Page 0x8000
Assembler
Block Number
Block Size 0x1000000
Bank Space 0x4000
Banks 00 / 0x000 / 0x7ff
Actions
Scan
Comments
by Arvika
RAW recovery
| Monolith SD_5 98 3a a4 93 2x2 |
Layout
PS8210 1106_1102 Xor 0561_256 v2
Mix
Input
Order 1/3/0/2
Join by Page
Parts 2
Page 0x200
Block Pair
Block 0x800000
Page 0x8000
Join by Page
Parts 2
Page 0x10000
Assembler
Block Number
Block Size 0x2000000
Bank Space 0x4000
Banks 00 / 0x000 / 0x7ff
Actions
Scan
Comments
by Arvika
RAW recovery
dump order can be other
|
|
| Monolith SD_5 98 3c a5 93 2x2 |
Layout
PS8210 1106_1102 Xor 0561_256 v2
Mix
Input
Order 1/2/0/3
Join by Page
Parts 2
Page 0x200
Block Pair
Block 0x800000
Page 0x8000
Join by Page
Parts 2
Page 0x10000
Assembler
Block Number
Block Size 0x2000000
Bank Space 0x4000
Banks 00 / 0x000 / 0xfff
Actions
Scan
Comments
by Arvika
RAW recovery
dump order can be other
| Monolith SD_5 98 de 94 93 1x1 |
Layout
PS8210 1106_1102 Xor 0561_256 v2
Mix
Input
Order 0
Block Pair
Block 0x400000
Page 0x4000
Assembler
Block Number
Block Size 0x800000
Bank Space 0x4000
Actions
Scan
Find Bank Size
Comments
by Arvika
Only RAW recovery possible
~55% good photos
| Monolith SD_5 98 de 94 93 1x2 |
Layout
PS8210 1106_1102 Xor 0561_256 v2
Mix
Input
Order 0/1
Block Pair
Block 0x400000
Page 0x4000
Join by Page
Parts 2
Page 0x8000
Assembler
Block Number
Block Size 0x1000000
Bank Space 0x4000
Actions
Scan
Find Bank Size
Comments
by Arvika
Only RAW recovery possible
~55% good photos
| Monolith SD_5 98 de 94 93 2x2 |
Layout
PS8210 1106_1102 Xor 0561_256 v2
Mix
Input
Order 1/2/0/3
Join by Page
Parts 2
Page 0x200
Block Pair
Block 0x800000
Page 0x8000
Join by Page
Parts 2
Page 0x10000
Assembler
Block Number
Block Size 0x2000000
Bank Space 0x400
Banks 00 / 0x000 / 0x3ff
Actions
Scan
Comments
by Arvika
RAW recovery
| Monolith SD_5 98 de 98 92 1x1 |
Layout
PS2251 1138_1132 v3
Mix
Input
Order 0
Cut Bad Bytes
Xor 5061
Block 0x204000
Page 0x2000
Module 256
BP Trash true
Block Pair
Block 0x204000
Page 0x2000
Block Cut
Block 0x400000/0x8000
Assembler
Block Number
Block Size 0x400000
Bank Space 0x2000
Banks 00 / 0x000 / 0x7ff
Actions
Scan
Comments
by Arvika
RAW recovery
|
|
| Monolith_SD_3 ec d5 14 b6 1x1 |
Layout
SM3254 528
Mix
Input
Order 0
Block Pair
Block 0x80000
Page 0x1000
Assembler
Block Number
Block Size 0x100000
Bank Space 0x400
Actions
Scan
Find Bank Size
Comments
By JeremyB - SD - GENERIC_2 - 100% Recovery
|
|
| Monolith_SD_5 98 3a 85 93 2x2 |
Layout
PS8210 1106_1102 Xor 0561_256 v2
Mix
Input
Order 0/2/1/3
Join by Page
Parts 2
Page 0x200
Join by Page
Parts 2
Page 0x8000
Assembler
Block Number
Block Size 0x1000000
Bank Space 0x800
Actions
Scan
Find Bank Size
Comments
by JeremyB
Only RAW recovery possible
~60% good photos
| Monolith_SD_5 98 d7 94 32 1x1 |
Layout
SD_20 v2 1109_1103 Xor 0561_128
Mix
Input
Order 0
Block Pair
Block 0x100000
Page 0x2000
Divide
Field Block Rotate
Value 0x10
Block Rotate
Block 0x200000
Page 0x2000
Assembler
Block Number
Block Size 0x200000
Bank Space 0x4000
Image Cut 0x2400000/(0x8000/0x4000/(0x4000/0x4000)*61/0x4000/0x8000)*8
Banks 00 / 0x000 / 0x7ff
Actions
Scan
Comments
Serg for forum 5919
| Monolith_SD_5 98 de 94 82 1x1 |
Layout
SD_20 v2 1109_1103 Xor 0561_256
Mix
Input
Order 0
Block Pair
Block 0x200000
Page 0x2000
Block Rotate
Block 0x400000
Page 0x2000
Assembler
Block Number
Block Size 0x400000
Bank Space 0x4000
Image Cut 0x01000000/(0x10000/0x8000/(0x8000/0x8000)*61/0x8000/0x10000
)*22
Banks 00 / 0x000 / 0x7ff
Actions
Scan
Comments
Serg for forum 6193
If first block in image is rotated, image Cut will work wrong
In this case make Raw Recovery
| Monolith_SD_5 98 de 94 93 1x1 v2 |
Layout
SD_20 v2 1108_1102 Xor 0561_256
Mix
Input
Order 0
Assembler
Block Number
Block Size 0x400000
Bank Space 0x4000
Image Cut 0/(0x8000/0x4000/(0x4000/0x4000)*125/0x4000/0x8000)*20
Banks 00 / 0x000 / 0x7ff
Actions
Scan
Comments
Serg for forum 10721
Raw Recovery
Only 50% photos was good
|
| |||
|
|
| Monolith_SD_5 ec d3 14 25 1x1 |
Layout
PS8000 528
Mix
Input
Order 0
Block Pair
Block 0x40000
Page 0x800
Assembler
Block Number
Block Size 0x80000
Bank Space 0x800
Banks 00 / 0x000 / 0x7af
Actions
Scan
Comments
By Arvika
FAT32 found at 0xc1f200
常见问题解答
Monolith SD_5在SD卡取证中有什么作用？
Monolith SD_5是用于SD卡数据提取的配置模块，它通过定义芯片型号（如98 3a 98 a3）、通道数（1x2）和闪存布局（Layout SD_20 v2）来识别存储芯片。该模块支持混合输入顺序（Mix Input Order 0/1）、异或值（Xor 5061）等参数，帮助取证人员从物理层读取原始数据，是电子取证中针对SD卡进行数据恢复或司法鉴定的基础工具。
如何理解SD卡取证中的'Block Pair'和'Join by Dump Parts'参数？
在SD_5配置中，'Block Pair'（块对）指定了需要配对处理的块地址（如0x600000），而'Join by Dump Parts 2'表示将两个转储部分按块大小（0xc00000）和页大小（0x4000）合并，以重建完整的逻辑数据流。这种参数设置用于处理因闪存磨损均衡或坏块导致的碎片化数据，确保恢复出的文件连续可读，常见于复杂SD卡数据恢复场景。
SD卡数据恢复时遇到'Trash false'和'Block Size 0xc00000'代表什么？
'Trash false'表示在提取过程中不丢弃任何数据块，即使某些块标记为无效或垃圾，也会被保留用于后续分析，避免遗漏潜在证据。'Block Size 0xc00000'则定义了闪存物理块的大小（以字节为单位），这是数据恢复的关键参数，用于正确映射逻辑地址到物理位置，确保读取的数据块与原始存储结构一致，提高恢复成功率。