See our newest innovations by joining the Forensic Technology Day 2019!

ACE Lab team is glad to share its experience in forensics data recovery at the FT-Day event, which will be held on September 25-26, 2019, in Karlsruhe, Germany. This closed 2-day event will gather over 100 computer forensic specialists and investigators from Germany to discuss the latest innovations and newest developments of the digital forensics industry.

This year we will deliver a presentation on recovering evidence from Media Cache of modern SMR Hard Disk Drives and a workshop on how to extract evidential data from the latest HDD and SSD using the all-new PC-3000 Portable III Solution.

What’s on the schedule?

We look forward to meeting everyone during the exhibition to talk over the recent trends and answer your questions!

We constantly expand and add new features to PC-3000 to meet your data recovery needs. Today we are glad to announce that the following English, Japanese, Korean and Chinese software updates are released:

• PC-3000 Express/UDMA-E/Portable Ver. 6.6.35
• PC-3000 SAS Ver. 6.6.35
• Data Extractor Ver. 5.9.22
• Data Extractor RAID Edition Ver. 5.9.22
• PC-3000 SSD Ver. 2.7.11

As always, you will find a lot of useful functions, options, new families of the drives, file systems and some optimizations inside the updated software. For example, the HotSwap procedure on Seagate F3 drives has been considered almost impossible until now. The ability to upload adaptives directly to HDD memory which appeared in this update is just the first step in this direction but it opens up wide horizons for working with any Seagate drives. The burning issue with Rosewood drives when you can’t safely recalculate the translator on SMR drives has also been successfully solved. By updating the software, you’ll get a "PWR_OFF" token to turn off the drive power before resetting the MC.

Also, you will be able to decrypt data that was previously unavailable because of the Unicode passwords and BitLocker encryption with few recovery keys version.

Besides, PC-3000 became the first data recovery tool that supports Deflate and LZVN compressed files from the APFS file system. To learn more, please read the lists of enhancements below.

All authorized technical support users will get the latest software versions.

Please contact us to learn more on how to become an authorized technical support user and receive all of the recent PC-3000 Software Updates:

RENEW YOUR TECHNICAL 
SUPPORT CONTRACT

A SHORT LIST OF THE MAIN ENHANCEMENTS:

PC-3000 Express, UDMA, Portable

Seagate F3

• Ability to upload adaptives from ROM to HDD memory (used for HotSwap);
• A token "PWR_OFF" has been added to the user command handler, which turns off the HDD power (allows organizing a safe recalculation of the translator on SMR drives, turning off the power before resetting the MC according to the terminal message).

Samsung

• For the F1_3D, F2_EG, F3, M7S2, N2B, F3_4D, M7E, F4_3D, F4, M8E, MT2, N3, MP4, M9T families, the test "Changing heads map in ROM" was added.

PC-3000 SAS

Seagate SAS

• New families have been added:
  • Savvio 10K.6;
  • Enterprise Performance 10K HDD v7;
  • Constellation ES.3.

Data Extractor

• Added virtual drive creating option based on marked folders.

Bitlocker & FileVault

• Unicode passwords are now supported;
• BitLocker encryption with few recovery keys version is now supported.

File systems

APFS

• Compressed files are now supported (Deflate and LZVN).

NTFS

• EFS v.2 is supported now.

Data Extractor RAID Edition

• Added RAID service blocks detection method based on entropy map.

PC-3000 SSD

SanDisk Marvell SSD Utility

• Added a new version of loader microprogram (Helen: 0.2.31, Veunis: 0.2.34).

CHECK OUT ALL THE NEW FEATURES HERE.

Do you ever feel stuck in your day-to-day data recovery work? Or, maybe you need the PC-3000 certification to advance your career?

If you answer 'Yes' to any of these questions and live in North America, we have good news for you! The schedule for the regular PC-3000 Data Recovery Training in Norwalk, CT, the USA, has been updated.

These classes are your chance to learn data recovery techniques faster, accelerate your progress with unique practical exercises and be prepared for almost all data recovery challenges. By attending the training, you will not only get the instructions on how to extract data from particular storage media devices but understand the core of the data recovery process. So it will be much easier for you to solve similar cases in your real life job.

This course will benefit data recovery engineers along with forensic examiners, detectives, investigators, information security professionals and law enforcement officers who specialize in digital forensics.

Ready to enrich your experience and get certified? Join the PC-3000 Training Courses in Norwalk, the USA:

Interested in arranging training at your facility? Then contact our Training Coordinator Jane.

This May, ACE Lab went to São Paulo, Brazil, to share its expertise in recovering data at the 4th INTERPOL Digital Forensics Experts Group Meeting which was held within the largest Forensic Sciences conference in Latin America - InterFORENSICS 2019. The events were conducted on May 21-24, 2019, in Frei Caneca Convention Center.

ACE Lab regularly attends the INTERPOL Digital Forensics Experts Group Meetings. This time was no exception and we gave the speech to over 100 forensic experts from 41 countries. The country members shared their experience in dealing with the latest challenges and developments in the digital forensics area.

Besides, our team took to the stage at the InterFORENSICS 2019 Conference as well. The presentation gathered a lot of attendees, indicating interest from digital forensics examiners, law enforcement agencies and academia members in Latin America. Roman Morozov provided his knowledge about the Media Cache (MC) in modern SMR Hard Disk Drives and its importance for forensics data recovery.

The thing is these drives use MC as an intermediate buffer to work with data. If the data portion transmitted via a single ATA command is less than half of the band, then the info will get into the Media Cache buffer before being written to the User Area of the HDD. Besides, as MC has a large volume (from 16 to 90GB), it may have data that user has been working on for a significant period of time – up to several months. Even if a criminal executes a complete erasing (e.g. filling with zeroes), it will be deleted on the User Area of the HDD, but Media Cache will still contain INFORMATION!

So, the session’s attendees found out how to view evidence stored in Media Cache and how to delete their own data from Media Cache for security reasons.

Summer is one of the best seasons for visiting Prague. The capital of the Czech Republic is especially beautiful when illuminated by bright lights of the summer days: narrow winding streets, flourishing city parks, fairy-tale castles… So why not to mix your holidays with business?

Come for the training, stay for the vacation!

▶ Build a foundation in data recovery from the variety of storage media
▶ Reinforce theory with hands-on exercises that help you "learn by doing" 
▶ Bring your own mind-breaking HDD, SSD, Flash and Monolith cases to the classes: you will be able to solve them under the supervision of our tutors or get useful tips on how to handle them when you get back to your lab
▶ Explore and enjoy the history and culture of the Czech Republic in your spare time

As a student, you will receive the best possible instruction and have the opportunity to ask questions that go beyond the scope of the course. As a tourist, you will get unforgettable experience and memories for a very long time.

*The dates given above are approximate. Actual dates may vary depending on the groups completeness.

Interested in arranging training at your facility? Contact our Training Coordinator Jane to get the details.