The PC-3000 Systems are considered to be the most cutting-edge solutions for diagnosis, repair and data recovery from damaged storage devices.

PC-3000系统被认为是诊断、修复和从损坏的存储设备中,硬盘数据恢复的最先进的解决方案。

The PC-3000 products have a lot of powerful functions that can be successfully used in the digital forensics field. The PC-3000 tools are often indispensable for cybercrime investigation. Even if a storage device is physically damaged, the investigative or/and judicial practice becomes possible due to the PC-3000 solutions.

PC-3000产品有许多强大的功能，可以在数字取证领域中被成功使用。对于网络犯罪调查来说，PC-3000工具通常是必不可少的。即使存储设备受到物理损坏，由于PC-3000解决方案，调查或司法实践也可能成为可能。

When digital evidence is required, it’s sometimes impossible to get access to the data from damaged or password-locked drives. PC-3000 Systems help to make the data accessible for the operation system to proceed with crime investigation. It is true fact that the PC-3000 solutions possess a powerful potential for helping forensic experts in their every-day work with damaged storage devices.

Below are some features that can be helpful for evidence collection.

下面是一些有助于收集证据的特性。

1. Support of forensic formats (*.E01; *.aff; *.s01; *.001.)

1.支持的法政格式(*.E01; *.aff; *.s01; *.001.)

A disk or a partition can be exported into a selected format (*.E01;*.aff;*.001)

可以将磁盘或分区导出为选定的格式(*.E01;*.aff;*.001)

        

And it is possible to create a task based on disk and partition images in *.E01;*.aff;*.s01;*.001 formats:

和有可能创建一个任务基于磁盘和分区镜像* .E01;* .aff;* .s01;*。001格式:

2. Possibility to export the lists of files and folders to CSV format and to calculate hash functions for folders, files, sectors and various sector ranges (using MD5 or SHA algorithms)

After that you will see a dialog window. You can mark which fields you want to see in the csv report.

And report will look like this:

3. Password reset for HDDs

When you don’t know the master or user password, you can use special utilitites to remove it.

E.g. This is how it looks like on Seagate F3 drives. If a drive has ATA password set, you will see the following:

And you can easily unlock it with Work with SA -> Reset passwords instrument

4. Raw recovery mode

Powerful “last resort” mode for finding file headers when you are unable to recover the file structure.

5. Check HPA

The PC-3000 products try not to look for data on the sectors that are out from translation. However, you can manually set max LBA and check if the hidden area contains any partitions or data.

6. Possibility to investigate the service area in order to find “backdoors”

From time to time, we hear news about backdoors and malware in data storage devices. IT experts can examine service area via the PC-3000 software.

7. Data copy creation and saving the data to several healthy storage devices

8. Possibility to build data storage maps for files, folders, used/unused spaces and metadata

The PC-3000 products also have some other useful features that can be used for helping forensic experts in getting digital evidence.

本文系转载，如有侵犯版权问题，请通知。我们立即删除。