PC-3000

From ForensicsWiki
Jump to: navigation, search

PC-3000

PC-3000 is a trademark of ACE Lab company located in Eastern Europe. It encompasses a range of drive repair and data recovery hardware-software solutions:

  • PC-3000 Express (hardware+software)
  • PC-3000 UDMA (hardware+software)
  • PC-3000 Portable (hardware+software, good for evidence acquisition)
  • PC-3000 SAS (hardware+software)
  • PC-3000 Flash (hardware+software)
  • PC-3000 SSD (software)
  • Data Extractor (software, has forensic features)

These tools are believed to be most reliable and powerful by over 15000 data recovery companies and engineers worldwide. PC-3000 software supports Windows OS, NT family.

PC-3000 Express

The PC-3000 Express Professional System is the most efficient hardware-software solution for recovering data from damaged HDDs based on SATA (Serial ATA) or PATA (IDE) interfaces for numerous vendors (Seagate, Western Digital, Fujitsu, Samsung, Maxtor, Quantum, IBM (HGST), HITACHI, TOSHIBA), for various capacities (from 500 MB to 6 TB), for file systems FAT, exFAT, NTFS, EXT2/3/4, HFS+, UFS1/2, XFS, ReiserFS, VMFS and virtual images VMDK, and VHD.

The PC-3000 Express System is a highly recommended data recovery tool when time and speed of data recovery are top priority, as four data recovery tasks can be performed at the same time at the maximum possible speed. The PC-3000 Express Professional System consists of the PC-3000 Express hardware-software and the Data Extractor Express software.

Check out the specs here

PC-3000 UDMA

The PC-3000 UDMA Professional System is a hardware-software solution for diagnosing, repairing and recovering data from damaged HDD based on SATA (Serial ATA) and ATA (IDE) interfaces for numerous vendors (Seagate, Western Digital, Fujitsu, Samsung, Maxtor, Quantum, IBM (HGST), HITACHI, TOSHIBA), for various capacities (from 500MB to 6 TB) and various form factors: 3.5" - desktop drives, 2.5" and 1.8" - laptop drives.

The PC-3000 UDMA Professional System consists of PC-3000 UDMA hardware-software and Data Extractor UDMA software.

Check out the specs here

PC-3000 Portable

The PC-3000 Portable Professional System is the mobile hardware-software solution for diagnosing, repairing and recovering data from damaged HDDs based on SATA (Serial ATA) and ATA (IDE) interfaces for numerous vendors (Seagate, Western Digital, Fujitsu, Samsung, Maxtor, Quantum, IBM (HGST), HITACHI, TOSHIBA), for various capacities (from 500 MB to 6 TB) and various file systems FAT, exFAT, NTFS, EXT2/3/4, HFS+, UFS1/2, XFS, ReiserFS, VMFS and virtual images VMDK, VHD. The PC-3000 Portable is the full-featured PC-3000 data recovery solution for situations when you need to recover data on-site. Due to its mobility, the PC-3000 Portable Professional System is widely used in forensic labs.

The PC-3000 Portable Professional System consists of the PC-3000 Portable hardware-software and the Data Extractor Portable software.

Check out the specs here

PC-3000 SAS/SCSI

The PC-3000 SAS/SCSI Professional System is the most powerful solution for recovering data from damaged HDDs with SAS (Serial Attached SCSI) and SCSI based interfaces, for capacities from 18 GB to 2 TB, for file systems FAT, exFAT, NTFS, EXT2/3/4, HFS+, UFS1/2, XFS, ReiserFS, VMFS and for VMDK or VHD virtual images. The new generation of the PC-3000 SAS/SCSI Professional System for recovering data from SAS and SCSI HDDs works with HDDs at the maximum possible speeds – it is limited only by the speeds of the HDDs.

The PC-3000 SAS/SCSI Professional System consists of the PC-3000 SAS hardware-software and the Data Extractor SAS software.

Check out the specs here

PC-3000 Flash

The PC-3000 Flash is based on ACE Lab's proprietary technology of getting direct access to Flash memory microchips. It is widely used for chip-off recovery. This technology greatly increases the chances of successful data recovery even when the storage device is physically damaged. The PC-3000 Flash contains an up-to-date large memory chip database that allows you to identify and read microchips in automatic mode. Complicated stack organizations which consist of several parts are automatically detected by the PC-3000 Flash as well.

Check out the specs here

PC-3000 SSD

The PC-3000 SSD Software System operates on top of one of the three up-to-date hardware platforms – PC-3000 Express, PC-3000 UDMA, or PC-3000 Portable – and it is intended for SSD diagnostics and data recovery from SSDs with SATA, PATA, mSATA, and M.2 (NGFF) interfaces and the capacity from 64 GB to 1 Tb produced by different manufacturers, such as OCZ, Corsair, Crucial, RunCore, A-DATA, G.Skill, Micron, Plextor, Intel, Samsung, Seagate, SanDisk, Kingston and others.

The PC-3000 SSD contains a set of specialized utilities for working with solid-state drives. This set includes the Universal Utility for diagnosing any SSD based on the ATA-8 specification (both currently existing models and those that will be manufactured in future) and the Active Utilities (Special Utilities) intended for working with a particular drive model in factory mode. It enables to deeply diagnose SSDs, to perform service operations, to re-write the drive's microcode, to get direct access to memory chips, to carry out low-level formatting blocking the damaged cells and placing their addresses into the defect table, and to perform many other useful operations.

PC-3000 Data Extractor

Using the Data Extractor you can create full (sector-by-sector) or partial data copies from the damaged drive to a good one connected to the port of the PC-3000 board, the motherboard or in image-files.

It is very important to read the maximum data volume in the shortest period of time as a damaged HDD can stop functioning at any time. The Data Extractor has integrated functionality for logical analysis of file systems which allows for reading of only necessary data. This technology greatly reduces the volume of read data, the duty cycle of damaged HDDs and the time required for data recovery. The Data Extractor has extended functionality for HDD reading:

  • HDD reading in factory mode
  • reading by head map
  • choosing the reading mode (UDMA 133/100/66/33, PIO 4/3/2/1/0)
  • read forward and backward
  • read ahead (cash function) disabling
  • autorelocation disabling
  • reading with hardware and software retries
  • reading with ignoring ECC
  • reading by used/unused sectors map
  • power supply control
  • software and hardware resets

The "Create virtual translator" option enables recovery of data from an HDD with a corrupted dynamic translator. File system metadata and user data are used in this mode.

There are some special modes for recovering data from logically damaged HDDs:

  • "Explorer" mode – to get access to the damaged partitions, folders and files
  • "Raw recovery" mode – to recover data when file system structures are catastrophically damaged
  • "Object map" mode – to work with fragmented structures (reading, copy creation etc)
  • "Quick disk analysis" mode – to solve cases with damaged information about partitions
  • "Partition data analysis" and other special modes for each file system – to recover data from specific damaged file system (including data deleted by users)
  • Modes for viewing and editing metadata in various file systems
  • Building maps of used/unused sectors, metadata and file system data

Using the Data Extractor Express for forensic purposes

The Data Extractor Express has special modes used by forensic investigators:

  • hash sum calculation for MD5 and SHA1
  • exporting catalogs list and files into csv format
  • building various maps: disk maps, used/unused sectors maps, file system metadata maps etc
  • unlocking the HDD
  • changing/resetting to factory value of MaxLBA HDD
  • HDD mounting in “read-only” mode
  • HDD data copy creation and reading to several recipients