The main principles of PC-3000 functionality
A Hard Disk Drive (HDD) consists of three main parts: the Hard Drive Assembly, the printed circuit board and the internal software. If one of these parts is damaged, the HDD does not work. The PC-3000 allows you to diagnose the HDD, fix damaged HDD modules, switch off defective heads, block access to the damaged area of magnetic surfaces, get access to the user data and many other functions.
HDD diagnosis can be done in standard (user) and technological (factory) modes. There are special PC-3000 adapters used for switching the HDD into technological mode to get access to the internal HDD software and user data.
To make initial diagnostics, the PC-3000 universal utility is launched. It diagnoses the HDD in user mode. The following checks are done: if the HDD is identified and if the HDD is password locked; check of surface access by LBA to the user data area and HDD translation system etc. If there are any HDD malfunctions, a special vendor-specific technological utility (intended for a specific HDD vendor) is used to repair the drive and gain access to user data in technological mode.
The PC-3000 Portable includes 16 special utilities used for various vendors, architectures and HDD families. Special utilities help to conduct HDD diagnosis on a low level, reveal damages and try to exclude them using special program methods and gain access to user data. If you wish to only repair the HDD and you do not need user data, you can make full drive initialization, switch off damaged heads, hide defects on the magnetic surface and reconfigure the HDD.
All specialized PC-3000 utilities are capable of performing the following actions:
- diagnose the HDD in technological mode;
- verify and recover the HDD service area;
- read-write Flash ROMs area;
- load service information access program – LDR;
- modify HDD heads configuration tables;
- review defect tables (P-list, G-list, T-list, etc.);
- hide found defects of magnetic surface;
- recalculate (initialize) translator;
- change configuration and identification parameters;
- reset logs and S.M.A.R.T parameters;
- watch and reset HDD passwords;
- work with the Data Extractor.
How to use the PC-3000 Portable to recover data
The most frequent reasons of HDD damage:
- failure of one or more magnetic-resistance heads
- damaged service information modules
- magnetic surface defects like scratches
- damaged PCB
- other damage
In many cases it is not necessary to fully repair the HDD to recover data. It could suffice to correct internal HDD software. This allows for temporal access to user data and you can read the required information.
- If one of the magnetic heads is damaged, we can get data access through the remaining heads using “MR-Head Shift technology”. The damaged head is substituted by the adjacent correct magnetic head. It allows for keeping the integrity of the translated data and for reading big data volumes without having to exchange the head stack.
- If there is a problem with the initial HDD initialization, the detailed start process log can show some information that helps to identify the damaged program modules with service information. Service area copies can be switched over to make the correct system head initialization. If the initialization process fails due to a problem with loading program modules into RAM, you can use the special Loader that creates essential HDD content into RAM.
- Technological mode allows for reading of data using physical parameters in PZCHS or line physical area with ABA. It is very often the only way to read data from significantly damaged surfaces.
- When the HDD PCB is damaged you can use another correct PCB taken from an HDD donor. This will save a lot of time in gaining access to user data.
- USB HDD access can be done using the COM port or adapted SATA HDD PCB.
How to use the PC-3000 Portable to repair HDDs?
The PC-3000 provides a wide range of functions for repairing HDDs. It enables the user to overwrite FLASH ROM, to switch off damaged magnetic heads, to detect and exclude damage in the HDD service area, to recalculate and overwrite service modules, to regenerate the translation system, to clean and reset S.M.A.R.T. logs and tables, to detect bad areas in magnetic surfaces and to exclude them from the HDD working area. Afterward, identification parameters are corrected (including serial number, model, capacity, etc.)
There are 5 main HDD repair stages:
- HDD PCB is diagnosed. It helps to evaluate how difficult it is to repair this HDD and if it is worth doing it. Board can be repaired or substituted by another board taken from an HDD donor. Flash ROM is checked for integrity and version correspondence. If necessary, they are rewritten from the PC-3000 resource database.
- Magnetic heads are checked, bad heads are disabled.
- HDD service area is diagnosed. Service information modules are checked on all copies. Damaged modules are recovered or overwritten in accordance with reference data. Some service modules are cleaned and logs are reset. Calibration is launched for those HDDs where it is possible to do it.
- Searching the bad sectors and tracks on HDD surfaces and hiding them. In case of seriously damaged surface and numerous bad sectors, this surface area is disabled. If defects are minor and local, separate areas can be switched off or defects can be hidden by using an HDD backup zone, HDD capacity remains the same. For some drives, SelfScan procedure can be launched.
- Available HDD logical space is determined. Max LBA parameters, model name, serial number etc are formed.
The PC-3000 Portable HDD firmware database
The PC-3000 Portable Professional system has a massive database of factory firmware resources: FLASH ROMs, service area modules, service area tracks and other HDD critical resources. The database is systematized and stores all data in compressed format. It allows getting quick and easy data access and sharing firmware resources between several PC-3000 Kits.
The main advantages of the PC-3000 database:
- FireBird database server is used (one of the most reliable SQL servers )
- adaptive indexation mechanism is used to speed up the search process
- shared firmware database can be created for use by several PC-3000 kits at the same time
- backup policy can be managed
- you can create a database with more than 4GB size
- you may add your own resources, for example, new objects, from the latest HDD models
- all users can exchange resources they have between each other
Dedicated modes for experienced users
There are two dedicated modes intended for experienced users: integrated script system and ATA commander.
Script system – allows creating algorithms used for issuing commands to HDDs in Visual Basic Script including data preparation and results interpretation. Advanced object model is used for getting access to HDDs. This object model is used by PC-3000 utilities. This algorithm can be added to any PC-3000 utility as a "user" mode.
ATA commander – interactive mode that allows issuing commands to HDDs (including technological commands) even by a user who does not have programming skills. You can set values for HDD registers (including registers for LBA 48 mode), and prepare and provide HDD data commands using a binary text editor. The sequence of supplied HDD commands can be classified by types and saved to file for later use or for sending to another PC-3000 owner. Judging from HDD command data, ATA Commander can generate script text for using it from Script system or as a "user mode".
PC-3000 Easy Mode
PC-3000 software received a new interface mode which makes user experience significantly easier and more efficient.
The new easy mode interface is a dashboard with quick-launch buttons allowing forensic experts, data recovery engineers and HDD repair technicians to perform a lot of routine, but necessary steps in automated mode.
These operations include:
1. Managing drive power.
2. Reading and analyzing drive identification data.
3. Reading and analyzing drive SMART data.
4. Performing quick drive test to check the drive's condition.
5. Performing complex test for comprehensive examination.
6. Removing password if a drive is security-locked.
7. Viewing Data (a DE task without copy creation).
8. Creating Data copy (a DE task with copy creation).
9. Working with previously created tasks.
The Easy Mode interface helps you solve simple cases quickly by saving time on many routine operations. Use it when you know the drive is not physically damaged. For physically damaged drives, it’s still highly recommended to use full PC-3000 functionality.
Simplified PC-3000 interface is essential for forensic experts when looking for evidence from damaged storage devices. It helps:
Those who are planning to enter the data recovery field will find the simplified interface extremely useful. The new PC-3000 easy mode enables them to organize and streamline drive identification, testing, data imaging and recovery operations. In the future the PC-3000 easy mode is expected to be enhanced with ready-made solutions for typical problems in specific drive families and models (selected automatically based on diagnostics results) as well as creation of copies with hash calculation in e01, aff, and raw formats.
- Analyse logically damaged drive
- Unlock Password
- View target data
- Create disk images
- Recover data using DE
Read more about the technical features and capabilities of the new interface in this blog post.