I am attempting to recover data from a flash chip removed from a proprietary device. I've dumped the chip and stripped out the OOB data.
Binwalk finds multiple squashfs partitions.
Sasquatch -s looks hopeful:
SquashFS version [4.0] / inode count [334] suggests a SquashFS image of the same endianess
Found a valid SQUASHFS 4:0 superblock on FF00000.squashfs.
Creation or last append time Mon Aug 9 13:01:47 2021
Filesystem size 15832.95 Kbytes (15.46 Mbytes) (16212941 [0xF763CD] bytes)
Compression lzma
Block size 262144
Filesystem is exportable via NFS
Inodes are compressed
Data is compressed
Fragments are compressed
Always-use-fragments option is specified
Xattrs are compressed
Duplicates are removed
Number of fragments 78
Number of inodes 334
Number of ids 1
sBlk.s.inode_table_start 0xf7430a
sBlk.s.directory_table_start 0xf75081
sBlk.s.fragment_table_start 0xf760ea
sBlk.s.lookup_table_start 0xf763b7
sBlk.s.id_table_start 0xf763c5
sBlk.s.xattr_id_table_start 0xffffffffffffffff
However attempting to extract files is failing:
sasquatch FF00000.squashfs
SquashFS version [4.0] / inode count [334] suggests a SquashFS image of the same endianess
Parallel unsquashfs: Using 1 processor
Trying to decompress using default lzma decompressor...
Trying to decompress with lzma-adaptive...
Trying to decompress with lzma-alt...
Trying to decompress with lzma-ddwrt...
Trying to decompress with lzo...
Trying to decompress with xz...
read_block: failed to read block @0xf75ef2
read_fragment_table: failed to read fragment table index
FATAL ERROR:failed to read fragment table
I am attempting to recover data from a flash chip removed from a proprietary device. I've dumped the chip and stripped out the OOB data.
Binwalk finds multiple squashfs partitions.
Sasquatch -s looks hopeful:
SquashFS version [4.0] / inode count [334] suggests a SquashFS image of the same endianess Found a valid SQUASHFS 4:0 superblock on FF00000.squashfs. Creation or last append time Mon Aug 9 13:01:47 2021 Filesystem size 15832.95 Kbytes (15.46 Mbytes) (16212941 [0xF763CD] bytes) Compression lzma Block size 262144 Filesystem is exportable via NFS Inodes are compressed Data is compressed Fragments are compressed Always-use-fragments option is specified Xattrs are compressed Duplicates are removed Number of fragments 78 Number of inodes 334 Number of ids 1 sBlk.s.inode_table_start 0xf7430a sBlk.s.directory_table_start 0xf75081 sBlk.s.fragment_table_start 0xf760ea sBlk.s.lookup_table_start 0xf763b7 sBlk.s.id_table_start 0xf763c5 sBlk.s.xattr_id_table_start 0xffffffffffffffff
However attempting to extract files is failing: sasquatch FF00000.squashfs SquashFS version [4.0] / inode count [334] suggests a SquashFS image of the same endianess Parallel unsquashfs: Using 1 processor Trying to decompress using default lzma decompressor... Trying to decompress with lzma-adaptive... Trying to decompress with lzma-alt... Trying to decompress with lzma-ddwrt... Trying to decompress with lzo... Trying to decompress with xz... read_block: failed to read block @0xf75ef2 read_fragment_table: failed to read fragment table index FATAL ERROR:failed to read fragment table
Any tips or pointers would be welcomed?