SSD external hard disk corrupted contain 70 BTC~!

[FNT]

agree but i already pass over all , the controller is damaged.

Can still companies recover it , even if the controller is damaged/ and sdd is encrypted?

ok, so if you already know that's 100% the controller? ok. (bad for this modell of SSD)
(100% sure not powerSoC, DC/DC, temperature sensor, transistor, diode, etc...)
So we're not talking about the NANDs, we are talking about Sandforce SF-2281 (like that) controller and we're talking about AES256
encryption for firmware and NANDs.
So a readout of NANDs is only interessting to make a copy / backup of NAND image, which is encrypted. (nothing to do with the TrueCypt)
The main problem there is that encryption, which is made from the Sandforce controller. So the 1:1 copy of NAND and
change the baord/etc... is NOT possible/working.

As I wrote, there are some rar! companies which complain about restoring data with this controller type, which was not possible in the past AND for sure
won't be done by "normal" recovering company. (I am not connected to any of these nor I have expi. with them!)
I also don't got any info about how they do this, as they state it takes time, it could be, that they trying to "break" ?? or "calculate"?? the key from the "old" controller? from NAND data?? I have no idea yet, how it could be done.

@Base16: yes that's true, mkae copy, etc.. BUT not the solution. NAND copy of course is "not that problem" (either to desolder or just with "cables")... (-> Sandforce)

The Sandforce SF-2281 controller, is soldered as VFBGA on the board, which I read maybe has a connection/solding problem, I know this kind of connection problems from other kind of this chips on other devices, BUT... not in this case for try-n-error ;-))

I'm also not happy about giving data away, and this is not and recommendation, but there currently there are three? kind of encryption:
- Controller -> AES256 to the the data in a "readable format" after that you have to use
(this is where external should be stopped - not giving any keys or passwaords.)
- TrueType (AES256, etc...) to decrypt the image/diskdata and then there is the
- wallet.dat encryption AES256-CBC+SHA512

Bye,

PS: "SSD stoped working" unfortunately, this is a know issue with that kind of SSDs moreover the controller from Sandforce
Edit/Update1: I read some sites/infos about the "Sandforce SF-2281" problem and noadays there are some tools around (from Sandforce) where you can update firmware, etc... so it seems to be possible to recover controller or change and make a update...
Update2: see firmware config of chips... just for info!!

NAND sample pinout:
 
Controller Sandforce:

Firmwareconfig Sandforce:
Firmwareconfig Sandforce:

[1714001489]

1714001489

[1714001489]

1714001489

[1714001489]

1714001489

[TheBeardedBaby]

WARNING, If you attempt the force replace the firmware, the info on the disk will be gone, together with the 70 bitcoins.
Here is the guide in English how to do it, here is the original Russian version and the video in the link of the warning message.

The guy perform the FW update also noted that after completing the process of recovery the data on the drive will be gone. Anyone speaking Russian can confirm it. He also said that if you need your data recovered you need to contact professionals.

DO NOT ATTEMPT THE ABOVE PROCEDURES, YOU'LL LOOS YOUR DATA!!

Another question. Any chance to have the seed, private key or the password for the wallet.dat saved on that disk, then you can be worried about sending the disk to someone?

[BASE16]

You first have to measure the voltage on the power pin of the controller chip to see if it is getting it's voltage.
If not then it is a supply issue and those are usually easy to solve.

If it does, then you have to check if the oscillator is running.
Sometimes there is a voltage on the power pin but the oscillator will not start and the chip remains frozen.

If there is a voltage and the oscillator is running then you can measure IO with a logic analyzer.

With these 3 steps you can try to isolate the problem by doing logic analysis.

[FNT]

As I wrote this is not a recommendation to do it so, nor a DIY instruction, etc...!
This is just a proof of, is it possible for someone? It could...

If you want to try it by your own, I would recommend to get some of the SSD of exactly same model/type
and try it with them, so it doesn't matter. Also get the right! tools for doing this (osci, logic analyser, SMD stuff, etc.. - not that expensive)

There is no pressure to do anything with the original SDD!?! the information is stored there for years, if it's there (wallet.dat) where is the problem?

In any case, I'd try to get a copy/backup of the NANDs, because there are the data on.
(this should be only done by someone how is 100% in knowledge what he's doing!)

If you have a copy you could also try to make a 1:1 copy, where I wrote not possibel because of encryption, but the software (firmeware updater) etc...
maybe it's possible with the orginal tool from Sandforce? (try it only on demo SSD or copied SSD, not orignal!!)

Bye,

[BASE16]

I realized it is hard if you do not have the right tools and equipment.

I have had several cases where the circuit board appeared dead because of an malfunctioning oscillator.
The oscillator provides the clock signal to the controller chip.
It's usually located very close to the chip itself.



Now believe it or not, these are mechanical devices.
They have a small crystal inside that physically vibrates at a very high frequency.

I have had cases where the oscillator would not start up and as a result the entire device appeared dead.

Now one of the first routines that i try when trouble shooting a device is to slowly tap and press on areas and components of the circuit board to see if there is any response and to look for faulty connections.
I have had several occasions where the device would spring back into life after i gave a small physical tap on the oscillator package.
The crystal appeared to be stuck and by giving is a small physical shock it started oscillating again.

So i knew then that the oscillator was the problem and after replacing the oscillator package the device worked as intended again.

But i do not think that this is the case with your device, it is just something you could try to see if it works without tools and equipment.
You could also put the drive in a watertight bag, the ones they use for phones and tablets, and put it in a cooler to cool it down, some devices start operating again if they are cool.

Anyway i have looked up the datasheet on this controller http://www.wintecind.com/oem/datasheets/wintecssd-wxssxxxg1ta-d41x_v1_08.pdf
And it appears that there are indeed issues with it because many people report that their drive is stuck in BSY or BUSY mode and will not get detected by BIOS.
This is essentially the same as the 'click of death' in mechanical drives where a drive would power up and just start clicking endlessly without any read write activity possible.
The drive would attempt to move data away from a damaged sector to another one like a maintenance cycle but go into an endless loop never giving back the RDY or READY and open IO to the ATA or SATA interface.
Of course in the case of SSD you will not hear anything because there is no moving head.

There is a pretty good chance that your drive is not broken but just stuck in an endless loop this is why you have to start checking from the input power up to the clock and then on to the chip itself to find the area that is preventing your drive from becoming live to the SATA interface on the motherboard of the computer.
Because once can exclude several issues that way and at some point you will find the problem and once you know the problem, you can apply the appropriate solution.

[FNT]

@private73123, is it possible to send two good pictures of the board, because that we know the chipsets and we have not to guess... ;-)

@Base16: "freezer trick" is a good idea!

Anyway, beside the oscillator, (a change is "quite simple"), also the (BGA) sandforce chip could have a bad connection....
also stated here: https://forum.acelaboratory.com/viewtopic.php?p=37894#p37894 (you might know)

About the SF firmware: read the manuals of the SandForce software "Genesis Utilities" which was written for OEMs / System Designers & SSD Manufacturers.
There you see how it works and things like "put the drive in ROM mode without using the breakout board", etc...

Backside of SF controller:

[private73123]

FNT
BASE16
TheBeardedBaby


controller image  https://pasteboard.co/JKD72Gf.jpg
detect information : https://pasteboard.co/JKD87OI.jpg
detect information ++ : https://pasteboard.co/JKD8lsA.jpg

-Any update to firmware is possible at this case? What i can conclude from the detection above ON THE PC.??

[TheBeardedBaby]

I just now read that the drive is visible in the system. I thought you said it's not detected at all.
I see someone tried to do rework of some components on the left side of the chip, not so nice work done there tho...
We need to know a few things.

Are there any components changed?
Was the drive visible in the system before those "repairs"?
Have you tried mounting the device directly, not trough the USB but directly to the mother board with SATA cable?

Get a proper picture of both sided of the drive. I did not expect so much physical "repairs" done.

if the drive is detected then it would be possible to update the firmware, but again a big WARNING! There is a high chance that the firmware update could delete the information on the drive.

If you don't have the password/seed/pr.keys saved on the drive and you have a strong wallet password, I again suggest that data should be recovered by someone who knows what he is doing.

[private73123]

I just now read that the drive is visible in the system. I thought you said it's not detected at all.
I see someone tried to do rework of some components on the left side of the chip, not so nice work done there tho...
We need to know a few things.

Are there any components changed?
Was the drive visible in the system before those "repairs"?
Have you tried mounting the device directly, not trough the USB but directly to the mother board with SATA cable?

Get a proper picture of both sided of the drive. I did not expect so much physical "repairs" done.

if the drive is detected then it would be possible to update the firmware, but again a big WARNING! There is a high chance that the firmware update could delete the information on the drive.

If you don't have the password/seed/pr.keys saved on the drive and you have a strong wallet password, I again suggest that data should be recovered by someone who knows what he is doing.

I will try the update of firmware on different similar harddisk to make sure data doesn't deleted . i am working carefully do not worry...

1- There are no component change as far as i know , well yes some people in the past try to fuck it it , the only thing i hope they did not fuck the chips. which i doubt from the images i see.
2- The harddisk is showing as you see.( not quite sure if it was showing before physically repair attempt before.
3- tried SSD tool from sandforce/Kingstone, for the update of firmware , the device is not showing inside it , even i tried another harddisk same module which is encrypted it show even before decrypting it . -> is there anyway else to try update firmware ?


photos: for both sides
https://pasteboard.co/JKDzT8R.jpg
https://pasteboard.co/JKDA75K.jpg

[Necez]

This is why you should always backup the hard drive where you plan to hold crypto coins. I always back up and place the backup to multiple external drives and so on. You should start doing this too once you recover your funds.

Now I am not sure if you can do much about this though. I would buy new SSDs which are the same exact model as yours and try some of the options given on these. Perhaps there is a way to recover if you use parts of new SSD or vice versa, but I am not an expert obviously just following some logic.

I wish you best of luck man. It would be a shame to lose that amount of money.

[FNT]

Hi

Thanks for pics and info! Ok, changes things, as you can read "something"!

Before you thinking about the firmware update, etc.. think about coping/backup the NANDs?

Have you tried the "freezer trick"? (SSD in a plastic bag so no humidity gets to the device!! and put it in the frezzer)
Like Base16 wrote? Read this: https://www.backblaze.com/blog/ssd-troubleshooting/#comment-3130139848

Demoing first, with an old/demo SSD.

Bye

[TheBeardedBaby]

I just now read that the drive is visible in the system. I thought you said it's not detected at all.
I see someone tried to do rework of some components on the left side of the chip, not so nice work done there tho...
We need to know a few things.

Are there any components changed?
Was the drive visible in the system before those "repairs"?
Have you tried mounting the device directly, not trough the USB but directly to the mother board with SATA cable?

Get a proper picture of both sided of the drive. I did not expect so much physical "repairs" done.

if the drive is detected then it would be possible to update the firmware, but again a big WARNING! There is a high chance that the firmware update could delete the information on the drive.

If you don't have the password/seed/pr.keys saved on the drive and you have a strong wallet password, I again suggest that data should be recovered by someone who knows what he is doing.

I will try the update of firmware on different similar harddisk to make sure data doesn't deleted . i am working carefully do not worry...

1- There are no component change as far as i know , well yes some people in the past try to fuck it it , the only thing i hope they did not fuck the chips. which i doubt from the images i see.
2- The harddisk is showing as you see.( not quite sure if it was showing before physically repair attempt before.
3- tried SSD tool from sandforce/Kingstone, for the update of firmware , the device is not showing inside it , even i tried another harddisk same module which is encrypted it show even before decrypting it . -> is there anyway else to try update firmware ?


photos: for both sides
https://pasteboard.co/JKDzT8R.jpg
https://pasteboard.co/JKDA75K.jpg

If you have access to the disk and it's shown in the system you can try to recover some data using programs like EaseUS

You need to connect the SSD to a PC as a second drive. If you need instructions, we can guide you trough.

I've been using this software for many years as we have a lifetime license but I never needed to recover files from SSDs so I don't know how good this will perform but it's worth trying before you take more serious actions.

A security tip for newbies. If someone tries to reach you on private messages, be very careful, never give access you your machine trough team viewer or similar software, keep conversations as public as possible so if there's a scammer it well be easily revealed.
Never give private keys, wallet files, seeds to anyone, don't let them see it.
70 Bitcoins is quite a serious amount of money and sure there will be people trying to steal it..

I often send pms to newbies to warn them about the possible scammer attempts, here I decided to post it so everyone ca see.

[jackjack]

I've been reading this thread for a few days but don't have contributed because there are already good advices
I just realized though that an youtuber I follow may help for this kind of recovery
I won't post here because I don't want the guy to be spammed with dozens of requests from people who just send mails to any people mentioned in a 'wallet help' thread (yes this happened before)
Anyway I sent it to private73123 and if future people sees this message and needs HARDWARE help, you can PM me
FWIW I don't know the guy at all, he just happens to have tons of video of him working at his shop so that's your job to search, trust and choose what you do with this guy

[BASE16]

I do not recommend you to update the firmware because it will overwrite the internal encryption key and you will loose all chance on a successful outcome.

Please read the datasheet.

AES-128 Data Encryption and Secure Erase
Upon initialization of the SF-2281 series SSD, an internal randomly generated AES-128 encryption key is generated in the controller. This
encryption key is not externally accessible, which ensures integrity of the encryption key and the data that it protects. This key is then
used to encrypt all data being written to the flash. Only encrypted data is written to the physical NAND flash chips, which ensures that
any data pulled straight from the NAND flash chips is undecipherable to unauthorized parties. When an ATA Secure Erase command is
sent to the drive, the controller erases and resets the internal encryption key, rendering the data in the NAND flash undecipherable. The
data allocation map data, all LBAs and SMART logs are also erased. The Secure Erase process takes less than 4 seconds to complete,
regardless of capacity. After the Secure Erase is completed, the drive is still functional, but the old existing data is unrecoverable.

Your words keep changing, first the drive is dead and then its showing up again.
This does not help in terms of trouble shooting.
You are wasting our time.

We can see that the drive is connected to a USB bus.
This does not help because you can not pull S.M.A.R.T reports over USB bus you have to connect the drive directly to a SATA interface and boot up the machine with a live dvd like Knoppix and then do further advanced analysis with Gnome Disks Smart Utility.

From this new information i can see that most likely your partition table has become corrupted.
This is not a problem because there are more then one copies of the partition table on the disk, you only have to restore it.
After that the disk will be back to normal and you can access the data again.
You can attempt a data recovery in Gparted but make sure to read the documentation first because you do not want to make things worse.

Windows is not a good candidate when it comes to disk utilities.
It will mount your drive in read write and add folders and files (and even delete) without notice for the recycler and indexing, you don't want to write on that disk so you have to mount it in read only on Linux to ensure that your data is conserved and protected.

[TheBeardedBaby]

Let's start from scratch again. Seems like the situation with the SSD it's different than described in the OP so I suggest start from scratch.

What we know until now is the following.

- The drive is discoverable, therefore the controller theory is out of the picture.
- The drive is connected trough the USB interface.
- There were physically repairs conducted, with unknown results.

If the OP wants to get those 70 Bitcoins out of this disk needs to answer a few questions, so please take your time to read and answer. I'll try to make simple and easy questions if OP's not an native English speaker.

1. Do you have a PC where you can connect the SSD directly to the mother board?
2. Do you know how to connect the SSD to the Motherboard?
3. Do you have experience with writing commands in the terminal?
4. Do you use any translating software to read/post comments, English level?
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Please answer those simple questions above so we can make a proper plan how to troubleshoot the issue.
If you have language problems, use google translate go answer my questions.

There's a high chance to recover the information from the disk.

-----
Thanks @LoyceV for the typo thing

[private73123]

I do not recommend you to update the firmware because it will overwrite the internal encryption key and you will loose all chance on a successful outcome.

Please read the datasheet.

traditional ways will not work , nor normal recovery , top proffestional ( LIMITED as in my country ) said controller is burned , maybe some people fucked it before with heat when they trying to repair .
i was shocked that it is giving a signal on the PC when i put , it was not before .

Can you message me with your telegram to work on this together please.


------


1. Do you have a PC where you can connect the SSD directly to the mother board?
2. Do you know how to connect the SSD to the Motherboard?
3. Do you have experience with writing commands in the terminal?
4. Do you use any translating software to read/post comments, English level?
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


1- Yes no problem
2- yes am not newbie it is possible
3- Expirence in writing commands in terminal - NO .. do you mean Linux/windows?
4- Why you ask this i do not understand. all information iam getting it clearly.

Device is showing on the manager , but not initialized , remember this brand of SSD is encrypted controller
+ the ssd is encrypted through truecrypt

Thanks

[LoyceV]

Also you could power it with the power cable that don't contain data lines and check voltages at control points.

Just a thought: if you're going to DIY a drive holding 70 BTC, start by buying a few identical drives to practice on! You don't want to make your current drive damage worse.

[TheBeardedBaby]

I start thinking now that maybe the drive itself has no problem but the problem is actually a corrupted TrueCrypt container which can lead to the same problems. TrueCrypt and SSD is not the best combination seems like it.

How about make a plan to start troubleshooting first the eventual software issues and the top priority is to analyze the error not try to fix it because it could lead to data loss, since it will be impossible to replicate the same issue on different hard drive.

I don't know if this would help but maybe raw clone the disk with something like Norton Ghost or https://hddguru.com/software/HDD-Raw-Copy-Tool/ if it gets trough. I never played with encrypted SSD, mechanical drives are much easier to recover.

1st. try to replicate the drive.
2dn. Analyze the encrypted partition.
3rd. If it's the partition then try to recover the MBR.

From experience I can say that there's much higher chance to get thinks working on an older machine, like 2011 model MB with SATAIII (3.0) controller, or from 2007 and before with SATAII. They work much more stable then the newest SATA releases. But this is just my personal experience.

[private73123]

I start thinking now that maybe the drive itself has no problem but the problem is actually a corrupted TrueCrypt container which can lead to the same problems. TrueCrypt and SSD is not the best combination seems like it.

How about make a plan to start troubleshooting first the eventual software issues and the top priority is to analyze the error not try to fix it because it could lead to data loss, since it will be impossible to replicate the same issue on different hard drive.

I don't know if this would help but maybe raw clone the disk with something like Norton Ghost or https://hddguru.com/software/HDD-Raw-Copy-Tool/ if it gets trough. I never played with encrypted SSD, mechanical drives are much easier to recover.

1st. try to replicate the drive.
2dn. Analyze the encrypted partition.
3rd. If it's the partition then try to recover the MBR.

From experience I can say that there's much higher chance to get thinks working on an older machine, like 2011 model MB with SATAIII (3.0) controller, or from 2007 and before with SATAII. They work much more stable then the newest SATA releases. But this is just my personal experience.

would you share your telegram in private so we can easier communication. thanks.


Regarding harddisk , i have read alot on SSD sandbase controller which make problems in 2014-2016 , thousands of cases have same problem , i do not know if anyone found a solution.

[TheBeardedBaby]

I start thinking now that maybe the drive itself has no problem but the problem is actually a corrupted TrueCrypt container which can lead to the same problems. TrueCrypt and SSD is not the best combination seems like it.

How about make a plan to start troubleshooting first the eventual software issues and the top priority is to analyze the error not try to fix it because it could lead to data loss, since it will be impossible to replicate the same issue on different hard drive.

I don't know if this would help but maybe raw clone the disk with something like Norton Ghost or https://hddguru.com/software/HDD-Raw-Copy-Tool/ if it gets trough. I never played with encrypted SSD, mechanical drives are much easier to recover.

1st. try to replicate the drive.
2dn. Analyze the encrypted partition.
3rd. If it's the partition then try to recover the MBR.

From experience I can say that there's much higher chance to get thinks working on an older machine, like 2011 model MB with SATAIII (3.0) controller, or from 2007 and before with SATAII. They work much more stable then the newest SATA releases. But this is just my personal experience.

would you share your telegram in private so we can easier communication. thanks.


Regarding harddisk , i have read alot on SSD sandbase controller which make problems in 2014-2016 , thousands of cases have same problem , i do not know if anyone found a solution.

You can reach me out on Discord, here's the official bitcointalk.org discord server, you can find me there   https://bitcointalk.org/index.php?topic=5247383.msg54403124#msg54403124