The PC-3000 Systems are considered to be the most cutting-edge solutions for diagnosis,?repair and data recovery from damaged storage devices.

PC-3000系統(tǒng)被認(rèn)為是診斷、修復(fù)和從損壞的存儲(chǔ)設(shè)備中,硬盤數(shù)據(jù)恢復(fù)的最先進(jìn)的解決方案。

The PC-3000 products have a?lot of powerful functions that can be successfully used in the digital forensics field.?The PC-3000 tools are often indispensable for cybercrime investigation.?Even if a storage device is physically damaged, the investigative or/and judicial practice?becomes possible due to the PC-3000 solutions.

PC-3000產(chǎn)品有許多強(qiáng)大的功能，可以在數(shù)字取證領(lǐng)域中被成功使用。對于網(wǎng)絡(luò)犯罪調(diào)查來說，PC-3000工具通常是必不可少的。即使存儲(chǔ)設(shè)備受到物理損壞，由于PC-3000解決方案，調(diào)查或司法實(shí)踐也可能成為可能。

When digital evidence is required, it’s sometimes impossible to get access to the data from?damaged or password-locked drives.?PC-3000 Systems help to make the data accessible for the operation system to proceed?with crime investigation.?It is true fact that the PC-3000 solutions possess a powerful potential for helping forensic?experts in their every-day work with damaged storage devices.

Below are some features that can be helpful?for?evidence collection.

下面是一些有助于收集證據(jù)的特性。

1. Support of forensic formats (*.E01; *.aff; *.s01; *.001.)

1.支持的法政格式(*.E01; *.aff; *.s01; *.001.)

A disk or a partition can be exported into a selected format (*.E01;*.aff;*.001)

可以將磁盤或分區(qū)導(dǎo)出為選定的格式(*.E01;*.aff;*.001)

? ? ? ??

And it is possible to create a task based on disk and partition images in *.E01;*.aff;*.s01;*.001 formats:

和有可能創(chuàng)建一個(gè)任務(wù)基于磁盤和分區(qū)鏡像* .E01;* .aff;* .s01;*。001格式:

2. Possibility to export the lists of files and folders to CSV format and to calculate hash functions for folders, files, sectors and various sector ranges (using MD5 or SHA?algorithms)

After that you will see a dialog window. You can mark which fields you want to see in the csv report.

And report will look like this:

3. Password reset for HDDs

When you don’t know the master or user password, you can use special utilitites to remove it.

E.g. This is how it looks like on Seagate F3 drives. If a drive has ATA password set, you will see the following:

And you can easily unlock it with Work with SA -> Reset passwords instrument

4. Raw recovery mode

Powerful “l(fā)ast resort” mode for finding file headers when you are unable to recover?the file structure.

5.?Check HPA

The PC-3000 products try not to look for data on the sectors?that are out from translation. However, you can manually set max LBA and check if the hidden area contains any partitions or data.

6.?Possibility to investigate the service area in order to find “backdoors”

From time to time,?we hear news?about backdoors and malware in data storage devices. IT?experts can examine service area?via the PC-3000 software.

7. Data copy creation and saving the data to several healthy storage?devices

8. Possibility to build data storage maps for files, folders, used/unused spaces and?metadata

The?PC-3000 products also have some other useful features that can be used for helping forensic experts in getting digital evidence.

本文系轉(zhuǎn)載，如有侵犯版權(quán)問題，請通知。我們立即刪除。