As you already know, this year 2019 marks 25 years since the PC-3000 Technology has been developed. Previously, we have published the PC-3000 history through the ages, the story of how the PC-3000 Technology has changed the world of data recovery industry. But what about the idea of the PC-3000 creation and how it came to the bright minds of the PC-3000 inventors?

To get answers to these questions let’s look back at the memories of Vadim Morozov, ACE Lab CTO & Founder:

«By the summer of 1993, the production and sales of the PC-2000 testers for repairing MFM / RLL drives with ST506 / 412 interface were in full swing! But, at the same time, our potential customers received a smaller and smaller quantity of such drives. They were replaced by new 3.5" HDD with an IDE (ATA) interface and a capacity of 40 MB: ST157A (Seagate), WD93044A (Western Digital), etc.

We understood that hard disk drives were changing, so we started researching these new IDE (ATA) HDDs. And the first solution was the IDE extension cassette for the PC-2000 Tester. It was designed to connect, test, verify and format IDE drives, displaying the numbers of the cylinder and head on the seven-segmented indicator of the PC-2000 tester. And that’s it! The functionality of the IDE extension cassette ended there. At that time, we didn’t even imagine about the existence of the Technological Mode and the Service Area of the drives. So we tried to find analog service information on the negative IDE HDD cylinders in the same way as with ST506 / 412 drives.

In April 1994, the situation radically changed!

Andrey Tarakhtelyuk and I planned our traditional visit to the service centers of the computer assembly companies for demos and possible sales. But our solution for IDE drives did not make any impression because it was not able to at least somehow return the broken IDE drives to life. To deal with them, it was necessary to show a large amount of information such as ID, tables of found defects, list of given commands, status and error registers of the drive, etc. Of course, the seven-segmented indicator didn’t allow to display all these things.

During our journey, we also attended the Comtech-94 Expo on April 25-29, 1994. It was our first time participating in such an event and we were just amazed! Modern computers from around the world, the legendary NEXT computer by Steve Jobs, a lot of software, various graphical interfaces, storage media devices, laser readers, etc. We were impressed by what we saw and our heads were spinning from the information we received!

After the event, we have come to a conclusion — the PC-2000 time was over.

But what a new tester for IDE drives should look like? Should it be independent with its own display and keyboard or should we make it on the basis of a PC? The next question was how to display information about the HDD on a computer screen if we choose the second option? I was so excited from all the events of that day that I could not fall asleep for a long time, I was thinking about different ways of working with HDD, the circuitry of a new tester, the possible arrangement of information on the computer screen…

I do not know what it was, but that night the user interface of a new tester came to me in a dream. Yes, that's exactly how it was!

When I woke up in the morning, I delightedly told Andrey about it and drew what the new PC-3000 tester should look like. The device should have its own display, keyboard and LED indicators of HDD status and errors. To control the keyboard there should be an additional digital field of the common PC keyboard, duplicating, in fact, its graphic image on the screen! The only one question remained — who could create us such an interface?

I came up with an idea to involve our close friend Vital Pryadkin who was developing graphical interfaces for medical devices. After returning from the trip, I phoned Vital and we agreed to meet on the weekend of May 2, 1994. It was a sunny day, apricots were blooming everywhere, we were sitting on the bench and discussing the project that in the coming decades would become the ultimate standard of tools for HDD repair and data recovery!”

                                                       

See our newest innovations by joining the Forensic Technology Day 2019!

ACE Lab team is glad to share its experience in forensics data recovery at the FT-Day event, which will be held on September 25-26, 2019, in Karlsruhe, Germany. This closed 2-day event will gather over 100 computer forensic specialists and investigators from Germany to discuss the latest innovations and newest developments of the digital forensics industry.

This year we will deliver a presentation on recovering evidence from Media Cache of modern SMR Hard Disk Drives and a workshop on how to extract evidential data from the latest HDD and SSD using the all-new PC-3000 Portable III Solution.

What’s on the schedule?

We look forward to meeting everyone during the exhibition to talk over the recent trends and answer your questions!

We constantly expand and add new features to PC-3000 to meet your data recovery needs. Today we are glad to announce that the following English, Japanese, Korean and Chinese software updates are released:

• PC-3000 Express/UDMA-E/Portable Ver. 6.6.35
• PC-3000 SAS Ver. 6.6.35
• Data Extractor Ver. 5.9.22
• Data Extractor RAID Edition Ver. 5.9.22
• PC-3000 SSD Ver. 2.7.11

As always, you will find a lot of useful functions, options, new families of the drives, file systems and some optimizations inside the updated software. For example, the HotSwap procedure on Seagate F3 drives has been considered almost impossible until now. The ability to upload adaptives directly to HDD memory which appeared in this update is just the first step in this direction but it opens up wide horizons for working with any Seagate drives. The burning issue with Rosewood drives when you can’t safely recalculate the translator on SMR drives has also been successfully solved. By updating the software, you’ll get a "PWR_OFF" token to turn off the drive power before resetting the MC.

Also, you will be able to decrypt data that was previously unavailable because of the Unicode passwords and BitLocker encryption with few recovery keys version.

Besides, PC-3000 became the first data recovery tool that supports Deflate and LZVN compressed files from the APFS file system. To learn more, please read the lists of enhancements below.

All authorized technical support users will get the latest software versions.

Please contact us to learn more on how to become an authorized technical support user and receive all of the recent PC-3000 Software Updates:

RENEW YOUR TECHNICAL 
SUPPORT CONTRACT

A SHORT LIST OF THE MAIN ENHANCEMENTS:

PC-3000 Express, UDMA, Portable

Seagate F3

• Ability to upload adaptives from ROM to HDD memory (used for HotSwap);
• A token "PWR_OFF" has been added to the user command handler, which turns off the HDD power (allows organizing a safe recalculation of the translator on SMR drives, turning off the power before resetting the MC according to the terminal message).

Samsung

• For the F1_3D, F2_EG, F3, M7S2, N2B, F3_4D, M7E, F4_3D, F4, M8E, MT2, N3, MP4, M9T families, the test "Changing heads map in ROM" was added.

PC-3000 SAS

Seagate SAS

• New families have been added:
  • Savvio 10K.6;
  • Enterprise Performance 10K HDD v7;
  • Constellation ES.3.

Data Extractor

• Added virtual drive creating option based on marked folders.

Bitlocker & FileVault

• Unicode passwords are now supported;
• BitLocker encryption with few recovery keys version is now supported.

File systems

APFS

• Compressed files are now supported (Deflate and LZVN).

NTFS

• EFS v.2 is supported now.

Data Extractor RAID Edition

• Added RAID service blocks detection method based on entropy map.

PC-3000 SSD

SanDisk Marvell SSD Utility

• Added a new version of loader microprogram (Helen: 0.2.31, Veunis: 0.2.34).

CHECK OUT ALL THE NEW FEATURES HERE.

Do you ever feel stuck in your day-to-day data recovery work? Or, maybe you need the PC-3000 certification to advance your career?

If you answer 'Yes' to any of these questions and live in North America, we have good news for you! The schedule for the regular PC-3000 Data Recovery Training in Norwalk, CT, the USA, has been updated.

These classes are your chance to learn data recovery techniques faster, accelerate your progress with unique practical exercises and be prepared for almost all data recovery challenges. By attending the training, you will not only get the instructions on how to extract data from particular storage media devices but understand the core of the data recovery process. So it will be much easier for you to solve similar cases in your real life job.

This course will benefit data recovery engineers along with forensic examiners, detectives, investigators, information security professionals and law enforcement officers who specialize in digital forensics.

Ready to enrich your experience and get certified? Join the PC-3000 Training Courses in Norwalk, the USA:

Interested in arranging training at your facility? Then contact our Training Coordinator Jane.

This May, ACE Lab went to São Paulo, Brazil, to share its expertise in recovering data at the 4th INTERPOL Digital Forensics Experts Group Meeting which was held within the largest Forensic Sciences conference in Latin America - InterFORENSICS 2019. The events were conducted on May 21-24, 2019, in Frei Caneca Convention Center.

ACE Lab regularly attends the INTERPOL Digital Forensics Experts Group Meetings. This time was no exception and we gave the speech to over 100 forensic experts from 41 countries. The country members shared their experience in dealing with the latest challenges and developments in the digital forensics area.

Besides, our team took to the stage at the InterFORENSICS 2019 Conference as well. The presentation gathered a lot of attendees, indicating interest from digital forensics examiners, law enforcement agencies and academia members in Latin America. Roman Morozov provided his knowledge about the Media Cache (MC) in modern SMR Hard Disk Drives and its importance for forensics data recovery.

The thing is these drives use MC as an intermediate buffer to work with data. If the data portion transmitted via a single ATA command is less than half of the band, then the info will get into the Media Cache buffer before being written to the User Area of the HDD. Besides, as MC has a large volume (from 16 to 90GB), it may have data that user has been working on for a significant period of time – up to several months. Even if a criminal executes a complete erasing (e.g. filling with zeroes), it will be deleted on the User Area of the HDD, but Media Cache will still contain INFORMATION!

So, the session’s attendees found out how to view evidence stored in Media Cache and how to delete their own data from Media Cache for security reasons.