PC-3000 HDD Data Recovery Advanced Training

by ACELabs
Home » Digital Forensic Training » ACELabs PC-3000 » PC-3000 HDD Advanced


The latest research has demonstrated that recovering data from a SEAGATE F3 drive is not easy – it is time consuming, and specific knowledge is required to find an appropriate solution for most difficult cases. That is why deep knowledge of Seagate is a crucial point for successful recovery.

Day 1 Highlights

The first day is devoted to learning about SEAGATE F3 HDD architecture. The disk structure and principles of operations are fully analyzed.

 

Day 2 Highlights

Seagate F3 HDD issues are presented, including root cause analysis. Attendees review complicated and tricky cases and learn methods how to solve them using the latest version of the PC-3000. Methods are demonstrated in practice exercises. These day will be also devoted to your questions about real HDD recovery cases.

 

Please Note: Only users with sufficient knowledge of the PC-3000 are admitted to this course. Attendees will need to have already completed the Expert HDD course at the ACE Lab Training Centre and/or have significant experience in HDD data recovery. Attendees are welcome to bring their own Seagate HDD they are unable to restore on their own. Laptops will be provided at the course location.

Course Details

USD$4350
  • Course Code: AT-PC3-ADV-HDD
  • Duration: 2 Days
  • Class Size: 3 min – 10 max
  • Additional Details:
  • • This class is open to forensic professionals and data recovery specialists.
  • • Due to the sensitive nature of our curriculum, and industry, all potential students are subject to vetting prior to enrollment. We reserve the right to refuse registration to any person that does not meet our established criteria.
  • * Prices will be converted to CAD at the time of quotation.
View Upcoming Classes

Course Content

  • HDD boot sequence from power-up to complete readiness. Terminal modes (ESLIP,
    Online, Diag), their availability during various boot.
  • Firmware structure and arrangement. Groups of system files (vol 0, 3, 5…).
  • Monitoring of system files loading progress in a drive. Methods for identification

    • of corrupted System Files using terminal commands (CtrlR, CtrlX, T>y) and by utility
    automatically detected information.

  • Media Cache. Definition, influence on drive operation, typical problems and their solutions.
  • Registry system file.
  • Saved Mode Pages system file.
  • 3.93, 3.17A, 3.346, 3.181, and 3.182 system files – their influence on HDD boot sequence,

    • availability of technological mode commands, typical problems and their solutions.

  • The “No Host PhysReadyStatus Flags” status.
  • HDD firmware overlays. Loader (definition, creation, usage).
  • Translator and its influence on HDD boot sequence and operation.
  • Work with defect lists (Servo Flaws list, TA list, P-List, Non resident G-list, Alt-list).
  • Translator restoration methods. Automatic and manual solutions of translation
    problems. Structures of involved objects, typical corruptions, opportunities for quick
    restoration in case of partial corruption.
  • Changes in drive configuration necessary at the beginning of work on it. HDD ID
    editing on SA surface and in RAM. Alt-List integrity analysis, the necessity
    and acceptability of clearing the DOS tables and SMART.
  • “Utility actions” for Data Extractor.
  • Physical HDD damage. Corresponding symptoms and recognition methods.
  • HDD controller damage cases. Searching for a controller donor.
  • Damaged magnetic heads. Detection, methods of HDD start using isolation
    of damaged heads. Selecting a head donor.
  • HotSwap. Theoretical background of the process, methods of HotSwap donor preparation.
  • Drives with locked factory mode. Description and unlocking methods.
  • The procedure of the read channel short circuiting to obtain access to the terminal
    of hung drives.
Terminal commands: the list of helpful commands with descriptions.

  • CtrlT
  • CtrlR
  • CtrlZ
  • CtrlL
  • CtrlX
  • T>Vx
  • T>ix,1,22
  • T>m0,6,2,,,,,22
  • T>m0,6,3,,,,,22
  • 1>N1
  • 2>x
  • 7>X
  • 7>m100
  • A>Fxxxx,xxxx,,10
  • C>Ux

Lab Practice:

  • Invalid extra defects in Non-resident G-List.
  • Detecting lost POST track defects.
  • Detecting a damaged head.
  • Using short circuit to restore access to data in a hung Seagate F3 HDD with
    corrupted Media Cache.
  • Obtaining access to technological mode in drives with firmware locks (locks
    of Lombard (Diag) and Grenada (Tech all) types).
  • Using the procedure of technological mode unlocking with a hung Seagate F3 HDD
    without FW lock for obtaining access to the terminal.

Upcoming Courses