Serial

The MD87050 has a RS323 connection on the processor board close to the hard disk USB B socket. The labelling of the pins seems to be switched, at least in my version.

Telnet

The MD87050 has a telnet server running which is accessible from its own WLAN and the WLAN it is connected to if any.

Credentials

The root credentials are as follows:

• User name: root
• Password: 20080826

Boot message

MTD layout

 cat /proc/mtd
 dev:    size   erasesize  name
 mtd0: 00800000 00010000 "ALL"
 mtd1: 00030000 00010000 "Bootloader"
 mtd2: 00010000 00010000 "Config"
 mtd3: 00010000 00010000 "Factory"
 mtd4: 00180000 00010000 "Kernel_RootFS"
 mtd5: 00010000 00010000 "params"
 mtd6: 00010000 00010000 "user_backup"
 mtd7: 00010000 00010000 "user"
 mtd8: 00600000 00010000 "Rootfs"

To back up all the devices insert a fat formatted SD card in the slot and run the following commands.

   # dd if=/dev/mtd0 of=/data/UsbDisk1/Volume1/mtd0.img
   16384+0 records in
   16384+0 records out
   # dd if=/dev/mtd1 of=/data/UsbDisk1/Volume1/mtd1.img
   384+0 records in
   384+0 records out
   # dd if=/dev/mtd2 of=/data/UsbDisk1/Volume1/mtd2.img
   128+0 records in
   128+0 records out
   # dd if=/dev/mtd3 of=/data/UsbDisk1/Volume1/mtd3.img
   128+0 records in
   128+0 records out
   # dd if=/dev/mtd4 of=/data/UsbDisk1/Volume1/mtd4.img
   3072+0 records in
   3072+0 records out
   # dd if=/dev/mtd5 of=/data/UsbDisk1/Volume1/mtd5.img
   128+0 records in
   128+0 records out
   # dd if=/dev/mtd6 of=/data/UsbDisk1/Volume1/mtd6.img
   128+0 records in
   128+0 records out
   # dd if=/dev/mtd7 of=/data/UsbDisk1/Volume1/mtd7.img
   128+0 records in
   128+0 records out
   # dd if=/dev/mtd8 of=/data/UsbDisk1/Volume1/mtd8.img
   12288+0 records in
   12288+0 records out

As seen in the list of MTD devices above mtd0 contains all data. Analysing mtd0.img with binwalk confirms this:

binwalk mtd0.img

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x72E03075, created: 2013-10-22 01:51:02, image size: 127844 bytes, Data Address: 0x80200000, Entry Point: 0x80200000, data CRC: 0xEEE7DEAB, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: none, image name: "SPI Flash Image"
104496        0x19830         U-Boot version string, "U-Boot 1.1.3 (Oct 22 2013 - 09:50:58)"
104976        0x19A10         CRC32 polynomial table, little endian
327680        0x50000         uImage header, header size: 64 bytes, header CRC: 0x65E07CA2, created: 2013-11-01 05:36:56, image size: 1442332 bytes, Data Address: 0x80000000, Entry Point: 0x80441000, data CRC: 0x8EFB6500, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
327744        0x50040         LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 4608121 bytes
2031632       0x1F0010        gzip compressed data, maximum compression, from Unix, last modified: 2017-06-06 09:44:49
2097152       0x200000        Squashfs filesystem, little endian, non-standard signature, version 3.0, size: 4736074 bytes, 1168 inodes, blocksize: 65536 bytes, created: 2013-12-10 09:54:46

A dump of the MTD devices and an extraction of recognisable data using binwalk is available in md87050-mtd-dump.tar.bz2

Sources:

Debian on the Intenso Memory 2 Move