PC-3000 Flash Data Recovery Advanced Training

by ACELabs
Home » Digital Forensic Training » ACELabs PC-3000 » PC-3000 Flash Advanced

The contents of this course differ significantly from the contents of the expert course. The program contains numerous practical exercises and tasks with minimal theoretical aspects. Attendees will need to have already completed the Expert NAND course at the ACE Lab Training Centre and/or have significant experience in NAND recovery.

What you’ll Learn:

  • Deeper knowledge and more specialized skills in Data Recovery from NAND-based devices
  • Tips how to operate the PC-3000 Flash at a professional level and how to solve complicated cases very quickly and efficiently
  • Official ACE Lab Data Recovery certification.

Flash Data Recovery Advanced Training Overview

Day 1 Highlights

On the first day, attendees get acquainted with new data recovery techniques using some modes of the PC-3000 Flash that make preparation faster and more efficient (deleting bad bytes, page transformation, etc.)

Day 2 Highlights

The second day is dedicated to solving interesting cases, demonstrating different advanced features of the PC-3000 Flash and using special instruments for data preparation. Students will also deal with uncommon cases, which require much more time to solve: specific recovery methods for complex UFD, Compact Flash and Secure Digital cards.

Course Curriculum

1. Opportunities and perspectives for using new version of the reader (version 4.0)

2. New structure of PC-3000 Flash

3. “Direct” TECH Mode reading of memory chip purpose

4. Modern types of memory chips

  • TLC memory chips. Features. Problems
  • Bad Column Management

5. New algorithms of reading the memory

  • SDR and DDR memory chips
  • «Special reading rules» of memory chips
  • WL Algorithm of reading

6. Manual adding of flash memory chips into database

  • Methods of detecting memory chips parameters detection

7. Background analysis at memory chip reading

8. Different ways of improvement final quality of memory chips reading

9. Bitmap

  • Bitmap as a tool for detection page transformation

10. Manual and Automatical ways of inserts determination

  • Bitmap as a tool for verifying the correctness of removing
  • Another ways of removing “Bad“ inserts

11. Map

  • Creating map considering legend
  • Map analysis
  • Save and load with Map

    12. Readout mode

    • Creating sub map with ECC
    • Analysis of mode parameters
    • Log analysis

    13. ReadRetry command. Why it is necessary to use it

    14. Special preparation modes

    • Channel synchronization
    • Block Rotation
    • Joining by block for N sources
    • Joining by Qword for N sources
    • Joining by bytes for N sources
    • Bank separation

    15. Advanced input mode for “Block Number Type 1” algorithm

    16. Compiler inside PC-3000 Flash

    17. Features of some popular controllers

    • Analysis of required data preparations and operations during data recovery
    • Work features of some translators
    • SM2236
    • SM2234H
    • SM3257EN
    • PS2251-03
    • Other

    18. Analysis and improvement of final image

    • Data quality Analysis
    • Block version
    • Shifts between banks
    • Disk analysis
    • Partition analysis
    • Adding of virtual partition

    Upcoming Courses