SECURITY 606SECURITY 606


Course PDF

On day one we introduce you to the basic hardware equipment used by data recovery professionals. We will discuss each tool's purpose, as well as pros and cons of each. This will begin to give you the vocabulary, basic knowledge, and groundwork needed to be able to continue discussions of what is possible in the lecture over the next few days. Some of the tools we will be looking at will be head combs, PC3000, Deepspar Forensic Disk Imager, Atola, and SalvationDATA's Data Compass & Platter Extractor tools.

We will break down the four main phases of data recovery. This will be followed by a discussion of the Myths surrounding hard drives and dispelling some of the existing beliefs, which will help you understand the truth verse marketing or false information.

We will then start with the anatomy of the drive and begin to break down what each item is, what it is called, and its function. A hard drive has an extremely large amount of planning involved with each part and function, and everything in the drive has a purpose. We will review each of the physical attributes and how they affect your ability to recover the data from the drive. Items discussed will include the Actuator Assembly, the Voice Coil, the locking pins, and the Pre-Amp, the circuit boards, the motor and spindle, as well as the platters themselves, which contain your data. Also examined will be the landing zone and the purpose and parking locations and why they were chosen.

Newer methods of recording to the hard drive, including perpendicular instead of longitudinal recording, will be discussed, and we will address what affect it has on your data and your ability to recover data. You'll hear actual recordings of sounds T sounds that hard drives make and see pictures and examples of the types of damage that has occurred. These steps will help you experience some of the types of problems you can learn about from the drives just by listening to them, feeling them, or examining them.

We will review the goals of the labs and display examples of what you will be performing during the lab and in what order it will be executed. There will also be a process for building your own head replacement tools from foil and foam that is better than almost any head combs that exist.

During the labs you will mount hard drives using USB connectors, format the drive, and put on the drive data that you will attempt to recover after you completely break the hard drive down to bare metal. You are going to very carefully disassemble two hard drives during the lab and extract all the parts, and then reassemble each piece and attempt to get the drive working again. Over the next two days we will do a total of five drives in order to ensure your success.

You will get an assortment of drives, giving you the advantage of seeing a variety of drives and the different way each is manufactured, increasing your skills at recognizing processes and parts. To help cement your understanding, we'll examine photos and videos of actual disassembled and repaired drives from which data has been recovered.

We will close the day with a display of how to match hard drives for donor drives. This is where you will learn what you need in order to acquire your parts to rebuild your damaged hard drives.




SECURITY 606 Upcoming Events
Event Location Dates Delivery Method
SANS CDI East 2009Washington DCDec 11, 2009 - Dec 18, 2009Live Event
Community SANS Atlanta 2010Atlanta, GAFeb 09, 2010 - Feb 13, 2010Community SANS
SANS 2010Orlando, FLMar 06, 2010 - Mar 15, 2010Live Event
SANS Security West 2010San Diego, CAMay 07, 2010 - May 15, 2010Live Event
"This is awsome! We're seeing details that most people don't even know exist" - John Wright, Info Tech, Inc.
"The class provided in-depth, real world, hands-on information" - Robert Dale Drollinger, General Dynamics
SANS Institute