PC-3000 Flash Data Recovery Advanced Training



The aim of this training course is to provide you with deep understanding of Flash NAND-based drives, including monolith devices. The program contains numerous practical exercises and tasks with minimal theoretical aspects.

What you get:
  • Deeper knowledge and more specialized skills in data recovery from NAND-based devices
  • Tips on how to operate the PC-3000 Flash at a professional level and how to solve complicated cases very quickly and efficiently
  • Official ACE Lab Data Recovery certification
  • Useful handouts

Course Details

$3,520

Course Code: AT-PC3-ADV-FLASH-SSD

Duration: 2 Days

Laptop Required: Yes

This class is open to all forensic professionals.

View Upcoming Classes



Day 1 Highlights
On the first day, attendees get acquainted with new data recovery techniques using some modes of the PC-3000 Flash that make preparation faster and more efficient (deleting bad bytes, page transformation, etc.)


Day 2 Highlights
The second day is dedicated to solving interesting cases, demonstrating different advanced features of the PC-3000 Flash and using special instruments for data preparation. Students will also deal with uncommon cases, which require much more time to solve: specific recovery methods for complex UFD, Compact Flash and Secure Digital cards.

 

Course Content

  • Opportunities and perspectives for using new version of the reader (version 4.0)
  • New structure of PC-3000 Flash
  • “Direct” TECH Mode reading of memory chip.
  • Modern types of memory chips
    • TLC memory chips. Features. Problems
    • Bad Column Managment
  • New algorithms of reading the memory
    • SDR and DDR memory chips
    • «Special reading rules» of memory chips
    • WL Algorithm of reading
  • Manual adding of flash memory chips into database
    • Methods of detecting memory chips parameters detection
  • Background analysis at memory chip reading
  • Different ways of improvement final quality of memory chips reading
  • Bitmap
    • Bitmap as a tool for detection page transformation
  • Manual and Automatical ways of inserts determination
    • Bitmap as a tool for verifying the correctness of removing
    • Another ways of removing “Bad“ inserts
  • Map
    • Creating map considering legend
    • Map analysis
    • Save and load with Map
  • Readout mode
    • Creating sub map with ECC
    • Analysis of mode parameters
    • Log analysis

  • ReadRetry command and why it is necessary
  • Special preparation modes
    • Channel synchronization
    • Block Rotation
    • Joining by block for N sources
    • Joining by Qword for N sources
    • Joining by bytes for N sources
    • Bank separation
  • Advanced input mode for “Block Number Type 1” algorithm
  • Compiler inside PC-3000 Flash
  • Features of some popular controllers
    • Analysis of required data preparations and operations during data recovery
    • Work features of some translators
    • SM2236
    • SM2234H
    • SM3257EN
    • PS2251-03
    • Other
  • Analysis and improvement of final image
    • Data quality Analysis
    • Block version
    • Shifts between banks
    • Disk analysis
    • Partition analysis
    • Adding of virtual partition

Only users with sufficient knowledge of the PC-3000 are admitted to this course. Attendees will need to have already completed the Teel Tech Expert Flash/SSD/Monolith course and/or have significant experience in NAND recovery. Attendees are welcome to bring their own devices they are unable to restore on their own. Laptops will be provided at the course location.



Course Offerings