Results 1 to 5 of 5

Thread: Hidden Files in Memory Stick

  
  1. #1
    vandurol123's Avatar
    vandurol123 is offline -Hacks Enthusiast
    Join Date
    Jun 2010
    Posts
    377
    Rep Power
    10

    Default Hidden Files in Memory Stick

    Hi,

    I recently formatted my memory stick through psp and i quickly removed the memory card to see what would happen. Obviously, everything is deleted but through one pass. (If you know what passes are). Also, it didn't recreate the folder either. Which I knew since I removed it quickly.

    So, since it was one pass. I tested if I could recover any data. When I did, I couldn't believe half of the junk I have that I didn't see before. I have a bunch of c++, header files, and .f from Google, Where I have NO clue how they got here. I don't download homebrew, and all I use is ISOs. I browsed google ONCE yesterday on google maps. But I didn't know header and C++ files were saved on the memory stick or cache for that matter.

    Proof:
    Code:
    // Copyright 2009 Google Inc.  All Rights Reserved.
    
    /**
     * @fileoverview Namespace for Google Earth website.
     * @author Michal Drewniak
     */
    
    /**
     * Namespace for Google Earth website.
     * @type {Object}
     */
    var earth = {};
    
    /**
     * Namespace for global variables used on the Earth website.
     * @type {Object}
     */
    earth.globals = {};
    
    /**
     * Trims leading and trailing spaces around a string.
     * @return {string} String without leading and trailing spaces.
     */
    String.prototype.trim = function() {
      return this.replace(/^\s*|\s*$/, '');
    };
    
    /**
     * Takes user to appropriate download page based on the locale.
     * Function called when user clicks on the download button.
     */
    earth.downloadEarth = function() {
      earth.download = new earth.Download();
      earth.download.chooseDownload();
    };
    
    /**
     * Stops default browser action.
     * @param {Event} e Event
     */
    earth.stopDefault = function(e) {
      if (e && e.preventDefault) {
        e.preventDefault();
      } else {
        window.event.returnValue = false;
      }
    };
    
    /**
     *  Extracts variables from the url based on the specified delimeter.
     */
    earth.parseURLVar = function() {
      var DELIMETERS = ['#', '\\?', '&'];
      var pipe = '|';
      var url = unescape(location.href);
      var arrURL = [];
      var vars = {};
      var tempVar = [];
    
      for (var i = 0; i < DELIMETERS.length; i++) {
        var regx = new RegExp(DELIMETERS[i], 'ig');
        url = url.replace(regx, pipe);
      }
      arrURL = url.split(pipe);
    
      for (var i = 1; i < arrURL.length; i++) {
        tempVar = arrURL[i].split('=');
        vars[tempVar[0]] = tempVar[1];
      }
    
      return vars;
    };
    
    
    /**
     * Extracts page id (relative url).
     * @return {string} Relative url path.
     */
    earth.getPageId = function() {
      var pageId = location.pathname;
      pageId = pageId.replace(/\/?intl\/.*?\//i, '');
      pageId = pageId.replace(/\/?earth\//i, '');
    
      // Removes preceeding slash.
      if (pageId.charAt(0) == '/') {
        pageId = pageId.slice(1, pageId.length);
      }
    
      return pageId;
    };
    
    /**
     * Appends additional scripts to the end of the file.
     * @param {string} url URL of the script we're appending. Usually json feed.
     */
    earth.appendScript = function(url) {
      var htmlTag = (document.getElementsByTagName('html'))[0];
      var scriptTag = document.createElement('script');
      scriptTag.src = url;
      scriptTag.type = 'text/javascript';
      htmlTag.appendChild(scriptTag);
    };
    
    /**
     * Extracts current locale info from language dropdown array.
     * @return {Object} object containing domain (.co.jp) and locale (ja).
     */
    earth.getLocale = function() {
      if (earth.dropdown.locale) return earth.dropdown.locale;
      if (earth.globals.locale) return earth.globals.locale;
    
      var langsSize = goog.web.languages.length;
    
      // Example languages[i]: ['Dansk', '.com', 'da', false]
      for (var i = 0; i < langsSize; i++) {
        if (goog.web.languages[i][3]) {
          var locale = {};
          locale['domain'] = goog.web.languages[i][1];
          locale['lang'] = goog.web.languages[i][2];
          return locale;
        }
      }
    
      if (!locale) {
        var locale = {
          'domain': '.com',
          'lang': 'en'
        };
      }
      return locale;
    };
    
    /**
     * Adds tracking to specified element.
     * @param {Element} link Link to which we'll add onclick analytics tracking.
     * @param {string} analyticsId Analytics ID.
     * @param {string} locale Current locale.
     */
    earth.addTracking = function(link, analyticsId, locale) {
      if (analyticsId) {
        link.onclick = function() {
          urchinTracker(analyticsId + '_' + locale);
        }
      }
    };
    
    /**
     * Executes tracking code.
     * @param {string} analyticsId Analytics ID.
     * @param {string} locale Current locale.
     */
    earth.track = function(analyticsId, locale) {
      if (analyticsId) {
        urchinTracker(analyticsId + '_' + locale);
      }
    };
    
    
    /**
     * Dynamically localizes links to some outbound sites.
     */
    earth.localizeLinks = function() {
      // English, do nothing
      if (earth.globals.locale['lang'] == 'en') {
        return;
      }
    
      /**
       * List of element ids which need to be localized.
       * 'element id' : 'type of the link (hl, intl)'
       * @type {Object}
       */
      var linkElements = {
        'linkSupport': '\?hl',
        'linkGallery': '&hl'
      };
    
      /**
       * Languages who's lang codes are different than those of the server.
       * 'lang + linkElements[el]': 'new lang'
       ' 'iw\?hl': 'he'
       */
      var langOverride = {
      };
    
      var lang = earth.globals.locale['lang'];
    
      for (var el in linkElements) {
        var currLink = document.getElementById(el);
        var overrideKey = lang + linkElements[el]
    
        if (linkElements[el] == '\?hl' || linkElements[el] == '&hl') {
          updateHl(currLink);
        } else {
          updateIntl();
        }
      }
    
      /**
       * Appends hl parameter to links.
       * @param {Element} currLink Currently parsed anchor.
       */
      function updateHl(currLink) {
        if (langOverride[overrideKey]) {
          // Update link with overridden locale info
          try {
            currLink.href += linkElements[el] + '=' + langOverride[overrideKey];
          } catch (e) {
            // Element doesn't exist.
          }
        } else if (currLink) {
          // Update link with currect locale info
          try {
            currLink.href += linkElements[el] + '=' + lang;
          } catch (e) {
            // Element doesn't exist.
          }
        }
      }
    
      /**
       * Appends or injects intl/xx directory into the path
       */
      function updateIntl() {
        // TODO: add code for changing intl links
      }
    };
    
    
    /**
     * Initializes functions used throughout Earth website.
     * Creates instances of objects used on the website.
     */
    earth.setUp = function() {
      var pageId = earth.getPageId();
      earth.globals.pageId = earth.getPageId();
    
      earth.dropdown = new goog.web.LangDropdown();
      earth.globals.locale = earth.getLocale();
    
      earth.localizeLinks();
    
      switch (pageId) {
        case '':
          earth.hppromo = new earth.HomepagePromo('pcO-d8z1IPLrU43D0QCTWLA/od6');
          break;
        case 'index.html':
          earth.hppromo = new earth.HomepagePromo('pcO-d8z1IPLrU43D0QCTWLA/od6');
          break;
        case 'download-earth.html':
          earth.download = new earth.Download();
          earth.download.initDownloadPage();
          break;
        case 'download-earth-advanced.html':
          earth.download = new earth.Download();
          earth.download.initDownloadPage();
          break;
        case 'download-earth-pro.html':
          earth.download = new earth.Download();
          earth.download.initDownloadPage();
          break;
        case 'thanks.html':
          earth.download = new earth.Download();
          earth.download.thanksDownloadEarth();
          break;
        case 'tour.html':
          earth.tour = new earth.Tour();
          break;
        case 'geoeye/':
          earth.globals.apibuildings = false;
          earth.globals.apioverlay = 'http://mw2.google.com/mw-earth-vectordb/' +
              'geoeye/images/image_copyright_geoeye2009_v2.png';
          earth.earthapi = new earth.EarthAPI();
          initFilmstrip();
          break;
        case 'geoeye/index.html':
          earth.globals.apibuildings = false;
          earth.globals.apioverlay = 'http://mw2.google.com/mw-earth-vectordb/' +
              'geoeye/images/image_copyright_geoeye2009_v2.png';
          earth.earthapi = new earth.EarthAPI();
          initFilmstrip();
          break;
        case 'mars/giovanni.html':
          earth.marsLanding = new earth.LandingPage();
          break;
        case 'news/':
          earth.news = new earth.News();
          break;
        case 'news/index.html':
          earth.news = new earth.News();
          break;
      };
    };
    
    function changeLanguage(dropdown) {
      if (earth.dropdown) {
        earth.dropdown.changeLanguage(dropdown);
      }
    }
    
    window.onload = earth.setUp;
    Also. I have a bunch of .elf Files but I know .elf files are made from the magic memory stick and CFW files. But I also have certificate files, many themes (the original themes, not custom themes), and documents which are full of hex values.


    I am still going through this to see If I can find any useful stuff. I don't know why but this is interesting.

    Any thoughts?


    EDIT: it seems that I recovered data from approximately a year ago as well. But like I said, I haven't mess with google much.

    Last edited by vandurol123; 07-26-2010 at 07:55 AM.

  2. #2
    fragon's Avatar
    fragon is offline -Hacks Neophyte
    Join Date
    Jul 2010
    Location
    FLORIDA
    Posts
    97
    Rep Power
    10

    Default

    why whould you do that man sry if i knew i would of Help

  3. #3
    ZiNgABuRgA's Avatar
    ZiNgABuRgA is offline Senior Member -Hacks Titan
    Join Date
    Sep 2006
    Location
    4CHIN
    Posts
    11,044
    Rep Power
    26

    Default

    That looks like Javascript, not C++ or header files.
    It makes sense if the browser is caching stuff to your MS.

    Unless you do a "full format", none of your data actually gets overwritten. "Passes" in formatting is often if you really care about security. A single pass is enough to erase data beyond recovery for the average user. Multiple passes are generally used by military and such to ensure that a data recovery specialist can't somehow figure out the previous state of the HDD magnets to recover data (typically it will involve passes which overwrite all bits with 0, then all bits with 1, and various random patterns).
    Last edited by ZiNgABuRgA; 07-26-2010 at 06:40 PM.

  4. #4
    pspjoke's Avatar
    pspjoke is offline Programmer -Hacks Guru
    Join Date
    Mar 2008
    Location
    U.S.
    Posts
    1,931
    Rep Power
    15

    Default

    Quote Originally Posted by ZiNgABuRgA View Post
    That looks like Javascript, not C++ or header files.
    It makes sense if the browser is caching stuff to your MS.

    Unless you do a "full format", none of your data actually gets overwritten. "Passes" in formatting is often if you really care about security. A single pass is enough to erase data beyond recovery for the average user. Multiple passes are generally used by military and such to ensure that a data recovery specialist can't somehow figure out the previous state of the HDD magnets to recover data (typically it will involve passes which overwrite all bits with 0, then all bits with 1, and various random patterns).
    IIRC then there wouldn't be a reason to do a multi-pass overwrite on flash media. Flash media doesn't leave a "trail". once something is actually deleted from the media, its gone forever.
    And i mean actually overwritten with 0's or 1's(one time), not just removed from the file table.

    But like i said.. i could be mistaken.

    @OP,
    seems that the psp only does a "quick format". And AFAIK it doesn't actually format the stick, just writes the data needed to tell the psp how to store data on it. (so your stuff isn't really being erased)
    Last edited by pspjoke; 07-27-2010 at 12:29 AM.

  5. #5
    vandurol123's Avatar
    vandurol123 is offline -Hacks Enthusiast
    Join Date
    Jun 2010
    Posts
    377
    Rep Power
    10

    Default

    That looks like Javascript, not C++ or header files.
    It makes sense if the browser is caching stuff to your MS.
    Could be, I assumed it was header files since it was recovered as a header file. Maybe it was just a mistake. I'll take a look into it more.

    so your stuff isn't really being erased
    Unfortunately I couldn't recover everything such as ISOs (probably since they are big in size.)


    I am still going through this. I have about 1000+ files in all different format. Lol.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •