Kingston 64GB mSD 983A98A376

05/24/2022 - 14:13
Kingston 64GB 983A98A376

 

  • Model: FD32B08UCT1-FA
  • Vendor: Toshiba
  • Identifier: 983A98A376 
  • Page size: 18432 bytes
  • Block size: 7077888 bytes (384 pages x 18432)
983A98A376 chip configuration

Chip configuration.

Micro SD adapter 6x4

This time it was possible to do without soldering, because these cool adapters from Multi-com are now available in the laboratory.

This chip has 4 crystals. The configuration suits without any changes.

983A98A376 page structure

The first thing that catches your eye is the blocks that do not have SA structures mixed with blocks having SA. Those are garbage blocks. Also, the end of the ECC contains an FF value that visually resembles a bad column and is a bit confusing. The page structure is typical of a Phison controller. The next task is to find the ECC codewords. And this is - PS_MicroSD_18342 (ecc116b) _16.bch

983A98A376 ECC

Many pages appeared corrupted, therefore, the entire dump was re-read using the found ECC.

983A98A376 ECC corrected

After re-reading the pages looks good. The not corrected pages shown in the image belong to the garbage block. Next, get rid of unnecessary blocks with help of the Offset tool.

983A98A376 offset

As the result - the required blocks are now in proper order without interruption.

983A98A376 XOR

XOR key analysis did not give any results. Applied Phison dynamic XOR tool. After, XOR key Phison(PS)\PS2251(16K_384p)_AF9E02.xor was found.

983A98A376 dynamic XOR

Now the Exif keyword search returned a lot of results and showed the structure of a well-known JPEG file.

Now we need to unite all the four dumps into one. If compare all dumps side by side, we see blocks have similar structures.

983A98A376 Unite

That means unite by page can be applied. Area size in Unite configuration is18432 bytes as the page size.

983A98A376 Unite params

Next, we need to solve the markers table.

983A98A376 markers table

Filtered out blocks with header value FFFF. Ordered by LBN. Test1 position 510,511 is for finding a boot sector.

983A98A376 scan results

 Then you need to perform a RAW scan because the file system failed to mount. All videos and images have been restored. Some files are corrupted due to bit errors. UFS Explorer even slightly restored the file system structure.