Forensic MP3 software

[roomaustin]

Hello, I am looking for specialized forensic mp3 data retrieval software for an old Sansa mp3 player from 2010. It has sensitive data I need recovered. It gave me a strange file error code when looking at it, it was labeled DID.bin. I have included the txt of the code I found on it. Not sure if it is sensitive however.

[saratoga]

There is no specific software for Sandisk mp3 players.  You may want to look around for forums that specialize in something like for advice this or reach out to a data recovery company. 

[roomaustin]

Have you ever seen this kind of file on a mp3 player? Do you know what kind of company I should look for when trying to retrieve information and other information from an mp3 player? I looked at software options and none of the trials could even open a sansa player and even look at the data that is on it at the moment.

[Bilgus]

IIRC that DID.bin file is placed there automatically by the Original Sansa Firmware. Is there some metadata that you could forensically investigate? probably, I do know that the OF does scan the disk for new files every boot but where that is stored or what format no clue.

We care nothing of the way the OF works besides to get our code running.

You can check the forums and wiki for some possible breadcrumbs on the files used in the OF but I personally can't think of too much reverse engineering going on with the other portions of the Sansa Original Firmware

[roomaustin]

Is there any way to retrieve old audio recordings that were once deleted on the device? Also what are the acronyms you are using? Do you know of any software?

[saratoga]

Is there any way to retrieve old audio recordings that were once deleted on the device? Also what are the acronyms you are using? Do you know of any software?

There are general techniques for recovering deleted files from storage devices and flash memory.  I'm not familiar with them but I'm sure you can read about them elsewhere on the internet. 

OF stands for Original Firmware (see rest of Bilgus's post). 

[roomaustin]

Here's the link to the files on my google drive that look out of standard, however, I don't know if any of them are malicious. I had this mp3 player around the time 0days such as stuxnet were used. There is also a store code on my mp3 player, except I don't believe I had a store account with anything. Unless they're cryptography codes, I might have tried installing rockbox on it at the time. All of these files look strange, I have never heard of a virus on a mp3 player... the store folder is BBEA714D-E376-4E44-92B9-5B5B2A4A2861 on a hidden folder labeled spotlight.v-100.


https://drive.google.com/drive/folders/1YTePt0kC60kzkJvmTZ6TRsH3LxT2anaU?usp=drive_link

[saratoga]

The spotlight.v-100 is used to help search for files, you can read about how it works on Google. Since this doesn't seem related to rockbox I'm going to close it.