Data Recovery Training

DATA RECOVERY TRAINING PROGRAM Duration: 5 Days

Participant Profile: Law enforcement officers, forensic personnel, forensic computing engineers, forensic computing specialists, electrical/electronic engineers, electrical/electronic technicians, and individuals interested in data recovery.

Basic Requirements: Basic computer knowledge, electrical/electronic knowledge, experience with disk structures, and manual dexterity.

Training Location: Fordefence Forensic Computing Laboratory (Fordefence Adli Bilişim Laboratuvarı / ŞİŞLİ / İSTANBUL)

Training Methodology:

• Theoretical Information
• Sampling
• Practical Exercises
• Case Studies
• Interactive Participation

Description:

This training provides comprehensive education on data recovery processes, an indispensable part of the forensic computing field. Students will gain hands-on experience in both logical data loss cases and data recovery processes that require physical intervention, aiming for more successful outcomes in forensic computing processes.

Day 1

• Anatomy of recording media, types of recording media (hard disks, CD/DVD/BluRay, memory cards, tape drives, etc.)
• Principles of working with recording media, precautions, and points to be careful about
• Data recording and reading technology
• Data loss and its causes, measures to prevent data loss
• Cases where data recovery can be successful or unsuccessful, file systems (FAT, NTFS, HFS, ext2/3/4, and others)
• Preliminary analysis of damaged media, safe electrical connection principles
• PCB fault diagnosis
• Firmware fault diagnosis
• Diagnosis of physical media errors in which data is recorded.
• Evaluation of the findings obtained.

Day 2

• Detailed PCB analysis methods (use of a voltmeter, oscilloscope, microscope)
• RAM failures on PCBs
• Main processor failures on PCBs
• Motor problems
• Read-write channel problems
• Servo decoder problems
• Selection and use of donor PCBs
• Evaluation of findings
• Data recovery lab environment
• General data recovery principles
• Problems and solutions specific to IBM/Hitachi disks
• Problems and solutions specific to Fujitsu disks
• Problems and solutions specific to Maxtor (old generation) disks

Day 3

• Problems and solutions specific to Western Digital disks
• Problems and solutions specific to Toshiba disks
• Problems and solutions specific to Quantum disks
• Problems and solutions specific to Seagate/Maxtor (new generation) disks
• Problems and solutions specific to Samsung disks
• Causes of data loss in CD/DVD/Blu-Ray and data recovery techniques
• Evaluation of data obtained from CD/DVD/Blu-Ray media
• Data recovery after formatting rewritable CD/DVD media
• Recovery of scratched/damaged CD/DVD/Blu-Ray discs

Day 4

• Special devices and tools used in data recovery processes
• Features, capabilities, and limitations of PC-3000
• Working principles of PC-3000: PCB analysis – Surface analysis – Testing the heads – Testing the motor – Making faulty disks operational
• Special devices and tools used in data recovery processes
• Capabilities and limitations of Salvation Data products
• Working principles of Salvation Data products: PCB analysis – Surface analysis – Testing the heads – Testing the motor – Making faulty disks operational

Day 5

• Advanced data recovery techniques
• Principles of data copying/cloning
• Repair operations for data recovery purposes: Head replacement, Platter replacement, Motor replacement
• Types, features, and causes of data loss in memory cards
• Data recovery from USB-based memories, MMC, SD, xD, CF, and other memory cards
• File systems used in memory cards
• Data recovery techniques from SSD disks
• Special devices and tools used in SSD data recovery processes
• Repair of memory cards for data recovery purposes
• Fundamentals of RAID systems and data recovery from RAID systems