5 ms·
Instead of FAT32, use the flash drive mapping. Flash drive contain mapping from sectors to blocks. This is used to deal with flash erasure, wear leveling, and f
by ianburrell 2mo ago
Instead of FAT32, use the flash drive mapping. Flash drive contain mapping from sectors to blocks. This is used to deal with flash erasure, wear leveling, and failures. Custom firmware could map the real filesystem to bad blocks.
Does the forensic software read the whole physical flash drive or just the logical one? They might if they want to get deleted files. Can they detect that there are lots of failures?
- Retr0id 2mo agoYou need the wear levelling system for actual wear leveling, otherwise the drive won't last very long. Competent forensic analysis can check the firmware and the physical flash contents, although most forensic analysis is not especially competent.
- forlorn_mammoth 2mo agowait, so the device has "good" blocks and "worn out" blocks... sounds like a binary format to me, maybe you could encrypt the data in that format... You can ship my genius award to me at X..x>X..X.