PC-3000 and Digital Forensics

cyber-crime

The PC-3000 Systems are considered to be the most cutting-edge solutions for diagnosis, repair and data recovery from damaged storage devices.

The PC-3000 products have a lot of powerful functions that can be successfully used in the digital forensics field. The PC-3000 tools are often indispensable for cybercrime investigation. Even if a storage device is physically damaged, the investigative or/and judicial practice becomes possible due to the PC-3000 solutions.

When digital evidence is required, it’s sometimes impossible to get access to the data from damaged or password-locked drives. PC-3000 Systems help to make the data accessible for the operation system to proceed with crime investigation. It is true fact that the PC-3000 solutions possess a powerful potential for helping forensic experts in their every-day work with damaged storage devices.

Below are some features that can be helpful for evidence collection.

Continue reading

Posted in Data Extractor | Leave a comment

PC-3000 DE. Data Extractor RAID Edition. How to find RAID configuration based on user files in Data Extractor RAID Edition

For some complex RAID cases ata Extractor RAID Edition has feature which allows to determine RAID configuration based on user files.Zip

Theory and methodology.
Let’s look into .zip files. They contain two types of data:
– zip metadata (structures which describe archive content, file names, size etc.)
– compressed files stored in archive.

Zip metadata are attractive to define RAID configuration:
– we can find them based on specific signature (0x504B0304)
– structures have simple periodical pattern.

Continue reading

Posted in Data Extractor, Video | Tagged , , , , , | 2 Comments

PC-3000 DE. Operations with maps in Data Extractor and bad sectors in MFT map

maps

Data Extractor supports following operations with map:
– Merge (two) maps;
– Intersection (two) maps;
– Merge (two) maps without crossing;
– Cut (another) map (from current);
– Compress map;
– Inversion map.

Continue reading

Posted in Articles, Data Extractor | Tagged , , , | 12 Comments

PC-3000 HDD. Toshiba drives specific diagnostics

In the Basic HDD diagnostics procedure post we looked at the common steps of diagnostics for any HDD.

Now we will look at the specific steps of diagnostics of Toshiba drives.

In this article we will discuss the typical situations on Toshiba drives.
There are a different Toshiba drives form-factor:
3.5″, 2.5″, 1.8″

01

Continue reading

Posted in Articles, Data Extractor, PC-3000 HDD | Tagged , , | 9 Comments

PC-3000 for HDD. Boot ROM mode (COM port) in WD utility for 3.5″ and 2.5″ drives.

79088_0

Sometimes we need to write or read the ROM image, but PCB or SATA adapter are damaged.

There is a way to work with ROM using a special mode – Boot ROM.

Continue reading

Posted in PC-3000 HDD | Tagged , , | 7 Comments

PC-3000 Flash. How to work with the problem memory chips.

There are a lot of different memory chips with reading problems such as not corrected ECC errors, dump filled by “FF” or other pattern etc.

In this article we would like to talk about different problematic memory chips and solutions for them.

Toshiba-256GB-TLC-NAND-Flash-Memory-Chip-620x400

Continue reading

Posted in Articles, PC-3000 Flash | Tagged , , , , , | 2 Comments

PC-3000 Flash. Grinding MicroSD with the help of Fibreglass Pen Brush

When we are speaking about monolith drive preparing for soldering, we should remember about one of the most important steps – grinding.

3-001

Grinding – is a special process of compound erasing from the bottom side of monolith device. During this process, engineer have to be very careful, because he can damage the cupper layer and make further monolith recovery absolutely impossible.

Continue reading

Posted in Articles, PC-3000 Flash | Tagged , , , , , | 6 Comments

PC-3000 HDD. Seagate F3. SMP flags issue

A lot of Seagate F3 drives have a problem with LED errors, RWerror problems or just stay in BSY state.
In this article we would like to consider the popular solution for such cases.
Here is Seagate Grenada drive with BSY state and LED:BD error in terminal report.

01

Continue reading

Posted in Articles, PC-3000 HDD, Video | 2 Comments

PC-3000 for HDD. Seagate F3 architecture drives specific diagnostics

In the Basic HDD diagnostics procedure post we looked at the common steps of diagnostics for any HDD.

Now we will look at the specific steps of diagnostics of Seagate F3 architecture drives.

Seagate F3

In this article we will discuss the most typical situations and scenarios of Seagate F3 drives diagnostics. We will not dive deep into the solutions since it can make this article endless. We just point out the way to understand the specific issue. Continue reading

Posted in Articles, PC-3000 HDD | Tagged , , , , | 8 Comments

PC-3000 for HDD. Seagate F3. 7 known situations when we can’t recover translator automatically

forks

The translator is quite a common failure on Seagate F3.
The typical sign is readable sectors at the beginning and unreadable sectors at the end. To be 100% sure that you have a translator problem need to built a headmap in DataExtractor and check the reading of some sectors by each head. As alternative you can check access to some of last sectors via Utility.

Continue reading

Posted in Data Extractor | 1 Comment