Joined: 26 Aug 2005 Posts: 7876 Location: Soft-Center
Posted: Sun Apr 13, 2008 3:41 Post subject: Example_1 - Mix
The term
There is a mix in flash memory, if the data blocks are split over parallel blocks. Usually 2 or 4. Groups of sectors in these blocks alternate from one to the other.
Purpose of mixes
Mixes are necessary to increase write speed of FLASH disk. Parallel blocks are written simultaneously. It is similar to a RAID-0 Stripe.
Check
It is the easiest to check for mixes within the table FAT. It is long enough and the data is predictable.
If sectors in FAT go consecutively, it means that a mix is not present. If groups of sectors are periodically skipped, then a mix is present.
Usually the groups consist of 1, 4 or 8 sectors. It is necessary to check over 20 sectors from the beginning of the FAT table to fully determine if a mix is present.
FAT table
Each entry of a FAT table shows the number of the following cluster that belongs to a file or folder.
Files can be fragmented, but the size of a fragment is no more than one cluster. So we look for continuously increasing sequences of numbers.
This will be sometimes broken by labels of the end of a file marker (FFFFFF0F), an empty FAT entry (00000000) or jumps to the following fragment.
The entry in FAT32 consists of four bytes:
Red are allocated:
05_00_00_00
06_00_00_00
07_00_00_00
08_00_00_00
09_00_00_00
0A_00_00_00
0B_00_00_00
0C_00_00_00
...
80_00_00_00
This sector has ended on 80_00_00_00 which means that the following sector should begin with 81_00_00_00:
This sector has ended on 00_01_00_00 which means the following sector should begin with 01_01_00_00:
Check some more sectors. You must clearly understand this.
As you can see, in this dump mixes are not present.