Topic: SSD external hard disk corrupted contain 70 BTC~! - page 2. (Read 1211 times)

Just a thought: if you're going to DIY a drive holding 70 BTC, start by buying a few identical drives to practice on! You don't want to make your current drive damage worse.

Let's start from scratch again. Seems like the situation with the SSD it's different than described in the OP so I suggest start from scratch.

What we know until now is the following.

- The drive is discoverable, therefore the controller theory is out of the picture.
- The drive is connected trough the USB interface.
- There were physically repairs conducted, with unknown results.

If the OP wants to get those 70 Bitcoins out of this disk needs to answer a few questions, so please take your time to read and answer. I'll try to make simple and easy questions if OP's not an native English speaker.

1. Do you have a PC where you can connect the SSD directly to the mother board?
2. Do you know how to connect the SSD to the Motherboard?
3. Do you have experience with writing commands in the terminal?
4. Do you use any translating software to read/post comments, English level?
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Please answer those simple questions above so we can make a proper plan how to troubleshoot the issue.
If you have language problems, use google translate go answer my questions.

There's a high chance to recover the information from the disk.

-----
Thanks @LoyceV for the typo thing

I do not recommend you to update the firmware because it will overwrite the internal encryption key and you will loose all chance on a successful outcome.

Please read the datasheet.


Your words keep changing, first the drive is dead and then its showing up again.
This does not help in terms of trouble shooting.
You are wasting our time.

We can see that the drive is connected to a USB bus.
This does not help because you can not pull S.M.A.R.T reports over USB bus you have to connect the drive directly to a SATA interface and boot up the machine with a live dvd like Knoppix and then do further advanced analysis with Gnome Disks Smart Utility.

From this new information i can see that most likely your partition table has become corrupted.
This is not a problem because there are more then one copies of the partition table on the disk, you only have to restore it.
After that the disk will be back to normal and you can access the data again.
You can attempt a data recovery in Gparted but make sure to read the documentation first because you do not want to make things worse.

Windows is not a good candidate when it comes to disk utilities.
It will mount your drive in read write and add folders and files (and even delete) without notice for the recycler and indexing, you don't want to write on that disk so you have to mount it in read only on Linux to ensure that your data is conserved and protected.

I've been reading this thread for a few days but don't have contributed because there are already good advices
I just realized though that an youtuber I follow may help for this kind of recovery
I won't post here because I don't want the guy to be spammed with dozens of requests from people who just send mails to any people mentioned in a 'wallet help' thread (yes this happened before)
Anyway I sent it to private73123 and if future people sees this message and needs HARDWARE help, you can PM me
FWIW I don't know the guy at all, he just happens to have tons of video of him working at his shop so that's your job to search, trust and choose what you do with this guy

If you have access to the disk and it's shown in the system you can try to recover some data using programs like EaseUS

You need to connect the SSD to a PC as a second drive. If you need instructions, we can guide you trough.

I've been using this software for many years as we have a lifetime license but I never needed to recover files from SSDs so I don't know how good this will perform but it's worth trying before you take more serious actions.

A security tip for newbies. If someone tries to reach you on private messages, be very careful, never give access you your machine trough team viewer or similar software, keep conversations as public as possible so if there's a scammer it well be easily revealed.
Never give private keys, wallet files, seeds to anyone, don't let them see it.
70 Bitcoins is quite a serious amount of money and sure there will be people trying to steal it..

I often send pms to newbies to warn them about the possible scammer attempts, here I decided to post it so everyone ca see.

Hi

Thanks for pics and info! Ok, changes things, as you can read "something"!

Before you thinking about the firmware update, etc.. think about coping/backup the NANDs?

Have you tried the "freezer trick"? (SSD in a plastic bag so no humidity gets to the device!! and put it in the frezzer)
Like Base16 wrote? Read this: https://www.backblaze.com/blog/ssd-troubleshooting/#comment-3130139848

Demoing first, with an old/demo SSD.

Bye

This is why you should always backup the hard drive where you plan to hold crypto coins. I always back up and place the backup to multiple external drives and so on. You should start doing this too once you recover your funds.

Now I am not sure if you can do much about this though. I would buy new SSDs which are the same exact model as yours and try some of the options given on these. Perhaps there is a way to recover if you use parts of new SSD or vice versa, but I am not an expert obviously just following some logic.

I wish you best of luck man. It would be a shame to lose that amount of money.

I will try the update of firmware on different similar harddisk to make sure data doesn't deleted . i am working carefully do not worry...

1- There are no component change as far as i know , well yes some people in the past try to fuck it it , the only thing i hope they did not fuck the chips. which i doubt from the images i see.
2- The harddisk is showing as you see.( not quite sure if it was showing before physically repair attempt before.
3- tried SSD tool from sandforce/Kingstone, for the update of firmware , the device is not showing inside it , even i tried another harddisk same module which is encrypted it show even before decrypting it . -> is there anyway else to try update firmware ?


photos: for both sides
https://pasteboard.co/JKDzT8R.jpg
https://pasteboard.co/JKDA75K.jpg

I just now read that the drive is visible in the system. I thought you said it's not detected at all.
I see someone tried to do rework of some components on the left side of the chip, not so nice work done there tho...
We need to know a few things.

Are there any components changed?
Was the drive visible in the system before those "repairs"?
Have you tried mounting the device directly, not trough the USB but directly to the mother board with SATA cable?

Get a proper picture of both sided of the drive. I did not expect so much physical "repairs" done.

if the drive is detected then it would be possible to update the firmware, but again a big WARNING! There is a high chance that the firmware update could delete the information on the drive.

If you don't have the password/seed/pr.keys saved on the drive and you have a strong wallet password, I again suggest that data should be recovered by someone who knows what he is doing.

FNT
BASE16
TheBeardedBaby


controller image  https://pasteboard.co/JKD72Gf.jpg
detect information : https://pasteboard.co/JKD87OI.jpg
detect information ++ : https://pasteboard.co/JKD8lsA.jpg

-Any update to firmware is possible at this case? What i can conclude from the detection above ON THE PC.??

@private73123, is it possible to send two good pictures of the board, because that we know the chipsets and we have not to guess... ;-)

@Base16: "freezer trick" is a good idea!

Anyway, beside the oscillator, (a change is "quite simple"), also the (BGA) sandforce chip could have a bad connection....
also stated here: https://forum.acelaboratory.com/viewtopic.php?p=37894#p37894 (you might know)

About the SF firmware: read the manuals of the SandForce software "Genesis Utilities" which was written for OEMs / System Designers & SSD Manufacturers.
There you see how it works and things like "put the drive in ROM mode without using the breakout board", etc...

Backside of SF controller:

I realized it is hard if you do not have the right tools and equipment.

I have had several cases where the circuit board appeared dead because of an malfunctioning oscillator.
The oscillator provides the clock signal to the controller chip.
It's usually located very close to the chip itself.



Now believe it or not, these are mechanical devices.
They have a small crystal inside that physically vibrates at a very high frequency.

I have had cases where the oscillator would not start up and as a result the entire device appeared dead.

Now one of the first routines that i try when trouble shooting a device is to slowly tap and press on areas and components of the circuit board to see if there is any response and to look for faulty connections.
I have had several occasions where the device would spring back into life after i gave a small physical tap on the oscillator package.
The crystal appeared to be stuck and by giving is a small physical shock it started oscillating again.

So i knew then that the oscillator was the problem and after replacing the oscillator package the device worked as intended again.

But i do not think that this is the case with your device, it is just something you could try to see if it works without tools and equipment.
You could also put the drive in a watertight bag, the ones they use for phones and tablets, and put it in a cooler to cool it down, some devices start operating again if they are cool.

Anyway i have looked up the datasheet on this controller http://www.wintecind.com/oem/datasheets/wintecssd-wxssxxxg1ta-d41x_v1_08.pdf
And it appears that there are indeed issues with it because many people report that their drive is stuck in BSY or BUSY mode and will not get detected by BIOS.
This is essentially the same as the 'click of death' in mechanical drives where a drive would power up and just start clicking endlessly without any read write activity possible.
The drive would attempt to move data away from a damaged sector to another one like a maintenance cycle but go into an endless loop never giving back the RDY or READY and open IO to the ATA or SATA interface.
Of course in the case of SSD you will not hear anything because there is no moving head.

There is a pretty good chance that your drive is not broken but just stuck in an endless loop this is why you have to start checking from the input power up to the clock and then on to the chip itself to find the area that is preventing your drive from becoming live to the SATA interface on the motherboard of the computer.
Because once can exclude several issues that way and at some point you will find the problem and once you know the problem, you can apply the appropriate solution.

As I wrote this is not a recommendation to do it so, nor a DIY instruction, etc...!
This is just a proof of, is it possible for someone? It could...

If you want to try it by your own, I would recommend to get some of the SSD of exactly same model/type
and try it with them, so it doesn't matter. Also get the right! tools for doing this (osci, logic analyser, SMD stuff, etc.. - not that expensive)

There is no pressure to do anything with the original SDD!?! the information is stored there for years, if it's there (wallet.dat) where is the problem?

In any case, I'd try to get a copy/backup of the NANDs, because there are the data on.
(this should be only done by someone how is 100% in knowledge what he's doing!)

If you have a copy you could also try to make a 1:1 copy, where I wrote not possibel because of encryption, but the software (firmeware updater) etc...
maybe it's possible with the orginal tool from Sandforce? (try it only on demo SSD or copied SSD, not orignal!!)

Bye,

You first have to measure the voltage on the power pin of the controller chip to see if it is getting it's voltage.
If not then it is a supply issue and those are usually easy to solve.

If it does, then you have to check if the oscillator is running.
Sometimes there is a voltage on the power pin but the oscillator will not start and the chip remains frozen.

If there is a voltage and the oscillator is running then you can measure IO with a logic analyzer.

With these 3 steps you can try to isolate the problem by doing logic analysis.

WARNING, If you attempt the force replace the firmware, the info on the disk will be gone, together with the 70 bitcoins.
Here is the guide in English how to do it, here is the original Russian version and the video in the link of the warning message.

The guy perform the FW update also noted that after completing the process of recovery the data on the drive will be gone. Anyone speaking Russian can confirm it. He also said that if you need your data recovered you need to contact professionals.

DO NOT ATTEMPT THE ABOVE PROCEDURES, YOU'LL LOOS YOUR DATA!!

Another question. Any chance to have the seed, private key or the password for the wallet.dat saved on that disk, then you can be worried about sending the disk to someone?

ok, so if you already know that's 100% the controller? ok. (bad for this modell of SSD)
(100% sure not powerSoC, DC/DC, temperature sensor, transistor, diode, etc...)
So we're not talking about the NANDs, we are talking about Sandforce SF-2281 (like that) controller and we're talking about AES256
encryption for firmware and NANDs.
So a readout of NANDs is only interessting to make a copy / backup of NAND image, which is encrypted. (nothing to do with the TrueCypt)
The main problem there is that encryption, which is made from the Sandforce controller. So the 1:1 copy of NAND and
change the baord/etc... is NOT possible/working.

As I wrote, there are some rar! companies which complain about restoring data with this controller type, which was not possible in the past AND for sure
won't be done by "normal" recovering company. (I am not connected to any of these nor I have expi. with them!)
I also don't got any info about how they do this, as they state it takes time, it could be, that they trying to "break" ?? or "calculate"?? the key from the "old" controller? from NAND data?? I have no idea yet, how it could be done.

@Base16: yes that's true, mkae copy, etc.. BUT not the solution. NAND copy of course is "not that problem" (either to desolder or just with "cables")... (-> Sandforce)

The Sandforce SF-2281 controller, is soldered as VFBGA on the board, which I read maybe has a connection/solding problem, I know this kind of connection problems from other kind of this chips on other devices, BUT... not in this case for try-n-error ;-))

I'm also not happy about giving data away, and this is not and recommendation, but there currently there are three? kind of encryption:
- Controller -> AES256 to the the data in a "readable format" after that you have to use
(this is where external should be stopped - not giving any keys or passwaords.)
- TrueType (AES256, etc...) to decrypt the image/diskdata and then there is the
- wallet.dat encryption AES256-CBC+SHA512

Bye,

PS: "SSD stoped working" unfortunately, this is a know issue with that kind of SSDs moreover the controller from Sandforce
Edit/Update1: I read some sites/infos about the "Sandforce SF-2281" problem and noadays there are some tools around (from Sandforce) where you can update firmware, etc... so it seems to be possible to recover controller or change and make a update...
Update2: see firmware config of chips... just for info!!

NAND sample pinout:
 
Controller Sandforce:

Firmwareconfig Sandforce:
Firmwareconfig Sandforce:

Anyone who tells you to hand over the encrypted private keys + encryption key to a 70 BTC, 2.598.820$ USD wallet to some unknown company is a complete nut and they and their advice should be avoided at all costs or you will suffer the consequences.
Trust no one.
They do not need your encryption key, they can just backup the raw data into image files without them even knowing anything about the contents.

It is true that it is risky if you never done things like this before and there is a chance that you will make things worse and that is why you have to study and gain information first up to the point where you are confident enough to take on the task.

The white area on the NAND chip is most likely residue from a sticker.
Your first task is to trouble shoot the device first to find out why it isn't working anymore.

In any case you can think about reading the data from each of these chips with an external interface and writing it to a second device of the same type to make a one on one copy of the drive.
You do not need any encryption keys to do this.
This way you can make a copy without ever revealing the encryption key to anyone.
Make sure you keep an eye on that drive, by this i mean do not mail it anywhere, it's not that they can steal your coins because it's encrypted but if it get's lost then your not getting them back either.

There are way's to read out the memory chips without having to remove them.
Number the chips and read them out one after the other into a compatible application there are various applications available to do this.
Because you do not have to physically modify anything to the drive this is a preferred method because you will not have to remove anything or heat it or anything that is a recipe for disaster.
You also do not have to solder anything onto the chips if you have a helper then you can hold in place the needle adapter on the chip while your friend presses start in the application that will read out the chip.



After you pulled the data to separate and numbered image files you can then copy it to another drive by using the same method in reverse on the new drive.
No encryption key needed.

After that you connect the new drive and recover your coins.

You have to be careful when placing the adapter make sure you got the correct side otherwise you could damage the chip.
You can look up the pin out by downloading the datasheet.

Encryption is a totally different ballgame. Depending on the complexity of the password and how accurate your guesses are, the time taken to bruteforce one could possibly be over your lifetime. That isn't the point of data recovery services who will only recover your data and the rest would be dependent on you. SSDs are significantly more complex than HDD however, from experience, I've seen more successful HDD restoration by just replacing the controller than HDD. Approach your local data recovery company, they would know best with them having the disk physically.

I'll say one thing, you can't diagnose the problem only with a picture and this is electronics it's not a car mechanics where you can change your brakes using youtube videos... this is way more delicate hardware to work with. On a picture you can detect only the physical damage if any.

I don't know where you are located and I cannot suggest a local company, but if I was you I would check those guys > 300dollardatarecovery.com

I have never used their service, I don't have any relations with them, I'm just reading people's comments about their service online. I would love to read if anyone had any experience with them tho.

There is a risk but seems that you pay if they manage to recover any files otherwise you pay only the shipping fees.

Again, this is just an option, not THE solution, you have to decide for yourself what you want to do.