PC-3000 Flash version 1.6.1 - Changes and enhancements

1. DEVELOPMENT OF AUTOMATIC RECOVERY AND ANALYSIS METHODS

Previously included methods of data research:

the determination of presence of alternation by byte;
the determination presence of inversion;
the determination of need to transform the sector structure;
the determination of presence of the character Interleave;
the determination of need for the additional conversions.

There are optimized speed of performance and authenticity of the determination of presence or absence of the declared object of experiment on the methods listed above.

Three new methods are added now:

determination of the block size;
determination of the parameters of the result associating;
complex method of the analysis.

Method of "Determination of the block size" is a the complex method which makes it possible to determine the size of block for the selected result with the high portion of probability and also the position of marker and to find out if it is present in the service page area.

The result of the method is represented and derived into the protocol in the following form:

-------------------------------------------------------------
Block size distribution by shift in service area
-------------------------------------------------------------
Marker shift in the sector: 512 Calculated value of the size of the block: 1024
Marker shift in the sector: 514 Calculated value of the size of the block: 1024
Marker shift in the sector: 516 Calculated value of the size of the block: 0000
Marker shift in the sector: 518 Calculated value of the size of the block: 0000
Marker shift in the sector: 520 Calculated value of the size of the block: 0000
Marker shift in the sector: 522 Calculated value of the size of the block: 0000
Marker shift in the sector: 524 Calculated value of the size of the block: 0000
Marker shift in the sector: 526 Calculated value of the size of the block: 0000

Each information line describes the assumed placement of marker in the service area. The size of block is calculated for each assumed displacement.
The calculated size of block =0 - means that on this displacement it can not be a marker. The identical sizes of block for several displacement say about the probable duplicating of marker in the service area.
Red color notes non zero values of the block dimensions. It is possible for the given example to draw the conclusion that the size of block in the given result = 1024 sectors, in this case marker is found through displacement 512 or 514.

Method " Type of result integration definition" is done to determine the type and parameters of association of two and more results. Its application is assumed after conducting of all remaining studies, with making of a decision about the method of the association of the received results before the application "Autodeterminations of algorithm".

Method "Complex method of analysis" enables to determine the presence of the selected for the analysis of conversions and, if necessary, to carry out appropriate actions which remove these conversions.

The method of searchs, including "Complex method", make it possible to analyze data of task in order to determine the need of preliminary preparation. Methods are accessible from the contextual menu, subparagraph "The methods of search".

If during the process of individual execusion of one of the methods, it is necessary to fulfill the actions of preliminary preparation of one of the method of searchs, so on the screen will be brought out the dialog box, which makes possible to confirm or to abolish the fulfillment of these operations. Upon the completion of process, the identifiers of the results obtained will be brought out into the protocol.

The selected method is applied to the results of preliminary preparation or the microcircuits of memory which are highlighted at the current moment. To isolate more than one result it is necessary to use Ctrl+Left keys of mouse. After this, contextual menu is caused by the right key of mouse. If the item of menu is inactive, it means that under the existing conditions you cannot start for the selected results.

Automation of making data ready for analysis

"Elimination of the character Interleave" method is added in the methods of "Preliminary preparation". It is done to completely fulfill the operations on the elimination of special Interleave in all results, to which the method is applied. You can take information about the presence, the type and the parameters of the necessary operations from the database of the tool. Inactive item indicates the absence in the microcircuits of memory in the task of the support of Interleaved Operation or the absence of the data about the support of such operations in PC-3000 Flash.

Information about the microcircuit is actively used by both methods of search and by methods of the data preparation. Hence, it is better to input the type of the used memory chip to use automatic modes as effectively as possible when you import previously read dumps into the task.

Autodetection of algorithm's type

The improvement of autodetection of type of used algorithm is one of the main changes introduced in 1.6.1 version. The time of fulfillment is considerably reduced and the authenticity of obtained results is increased.

The autodetection of algorithm in version 1.6.1 is carried out into 2 stages:

the preliminary analysis: it makes possible to verify the presence of algorithm, being based on the rapid signs,
the complete analysis: detailed analysis of result done to detect the signs of one or another algorithm.

At any stage of analysis, upon the detection with the high portion of probability of the presence of signs of one of the algorithms, the process can be interrupted and probable method is used.

You can anticipate the method of the algorithm autodetection when you study the task data on to find out if it is necessary additional conversions. The enumeration of the executed operations can be changed with the aid of the appropriate flags of dialog box. At the starting on the unit "Microcircuits of memory" all permissible steps of preliminary analysis for the specific objectives are selected on default. They are taken off with the starting on any of the results of preliminary preparation. If item in the list "Methods of search" is inactive, this indicates either impossibility or irrationality to esecute this operation.

If while searching the task data, non-zero probability is determined for more than one version of the further operations, then PC-3000 Flash will continue the algorithm of analysis in the most possible way. In this case the corresponding messages will be brought out into the protocol. These messages allow to use the alternative variant of sequence of operations in the case of unsatisfactory result.

Information about the obtained signs of algorithms is derived on the completion of process into the log together with the information about their probability.

2. ADDED ALGORITHMS

There is added algorithm for the controllers SM321QF BB ("translator type 6"). It is accessible in the group "translator". The mode of the autodetection of the parameters is realized for the algorithm.

There is added algorithm for the controller SM324QF BC ("translator type 7"). It is accessible in the group "translator". The mode of the autodetection of the parameters is realized for the algorithm.

There is added algorithm for the controllers AlcorMicro AU6984. It is accessible in the group "Translator". Subgroup "Translator the type 2 AU6x8x". The mode of the autodetection of the parameters is realized for the algorithm.

Autodetection of algorithm's type

We added autodetection of the parameters in the algorithms:

number of block type 1
number of block type 2
number of block type 4
number of block type 5
number of block type 7
translator type 6
translator type 7

At the established flag "To determine the parameters automatically", the analysis and the attempt will executed to determine the necessary parameters. If it is impossible to determinate it, the corresponding information will be brought out into the protocol about the possible alternative ways out or the problems.

Recovery via controller

The support of the following new controllers is added in the PC-3000 database.

OTI001681 BF240325 105400
CBM2090 B72175-15E
UT163-L6 APCE005 0645 A1B
OTI1006828 BV351035.10349M
OT1002168 AY48180N
UT163-L04 8P00300 0740 A18
6671 A1-L5C D0NF5-010 0353D
UT161-T6G PCA107 0626JA-A2
SM324QF BC A93664 0808
SM321QF BB H21018 0729 S8T
UT163-T6 APD0163 0718 A1B
AU6984 A53-MHL-GR A96205-1F 0817
PS2136CC-G UT0650 AHTY9
U20TW0E 0515 D1P8-010SFK
MB2B 0709
Pl2528 LF07243A SD33YT01
U6288 E 0336 TH05 GHFMMA00000H
PL-2515 03484D
UT163-QF4 APD0359 0745 A1B
SM321QF BB H13213 0642
SM321QF B8 H12165.01 0640
SM321QF BB H12169 0635 S8T

3. NEW THINGS IN SERVICE

To improve the clarity and facilitating of tracking of the actions' chronology, the information line is added to each intermediate result. The line contains the parameters of operation through which the result was obtained.
After the autodetection of the parameters is done, all parameters are derived into the protocol of task in the framework of the algorithm of analysis.
After the autodetection of algorithm is completed, all results with non-zero probability are derived into the protocol.
The modal window of the form of autodetection mode algorithm is substituted by MDI, which makes possible to work with several tasks in the process of fulfilling this operation.
There is realized possibility of saving any intermediate result into the file. The possibility is accessible from the contextual menu of the result of preliminary preparation.

4. CHANGES IN "COLLECT INFORMATION" MODE

The dialog box of the mode "Data collecting" in version 1.6.1 has the following elements of control:

Path to the file of the data collection: the file remains into the catalog of task with a certain name on default. The path to the file and also name can be changed.
Report Generation for:
The successful cases - it is adviced to carry out in the case of the successful data recovery. It makes possible to add this controller into the PC-3000 Flash database and to accelerate the process of data recovery from analogous flash drive in the future.
For unsuccessful cases - it is recommended to carry out in the case if recommended methods of recovery do not give successful result. On the basis of file, which is formed by program, specialists of company will give recommendations regarding the data recovery from the drive.
to carry out the preliminary analysis: the presence of a number of specific conversions in the results of task considerably decreases the effectiveness of the mode "Data collecting", that is why the installation of this flag will allow the tool to analyze initial dumps on the presence of the such conversion and to remove them.
information about the task: please, introduce markings of the controller the memory chips and the type of accumulator as detailed as possible (completely all that is written on the surface). This information IS VERY important when you analyse the task and add the controller into the PC-3000 Flash database.

5. ELIMINATED ERRORS

We eliminated the significant number of errors, which led to the unstable work of the tool.

6. RECOMMENDATIONS ON THE DATA RECOVERY METHODS IN NEW VERSION

After the successful creation of task and reading of all microcircuits of memory, if the required controller was not located in the PC-3000 Flash database, it is necessary to become to the unit "Chips" and to activate method "Autodetection method of analysis" from the group "Data analysis".

The dialog box for selection of the sequence of operations will appear on the screen. On the basis of number of signs, PC-3000 Flash makes inactive those actions which are impossible to be fulfilled or it is not recommended to make in the current task.

It is recommended to leave accessible modes on default. But, if it is known for sure in advance that one or another special feature is absent in the task, the appropriate flag can be removed which will make possible to accelerate the process of analysis.

At searching, the explaining messages and the key moments of process are shown in the protocol . In the case of detection in the process of searching one or other special feature, the PC-3000 Flash will carry out elimination automatically. If several possible versions of operations are detected then the most probable will be carried out . In this case the alternatives are shown in the protocol.

Information on the last result which is obtained in the process of the work of complex method, will be brought out into the protocol. After the search process is completed, the "Autodetect" mode will be automatically started.

This operation is carried out into 2 stages: preliminary and complete.

If at any stage the possible method of analysis is reliably discovered then process can be interrupted after selecting the necessary method, you should launch the necessary method.

It is recommended to use "Autodetect" mode for the selected algorithm. If the parameters are known then it is possible to indicate the parameters clearly after abolishing automatic mode.

Go up

Go Home