Advice please chaps...
 
Notifications
Clear all

Advice please chaps (data recovery course - PC3000 etc)

6 Posts
3 Users
0 Likes
804 Views
(@rich2005)
Posts: 535
Honorable Member
Topic starter
 

Afternoon everyone,
I'm considering a few training options, and the thought crossed my mind to consider some physical data recovery options.
Does anyone have any UK based providers of training that they'd highly recommend. Just to be clear, I'm not talking EnCase/FTK or anything like that. I'm thinking more along the lines of PC3000 and/or other stuff for drives that are physically problematic (whether via moving part issues, controller board, or firmware type problems etc).
Also to further clarify, this would ideally be done with consideration to the forensic implications, if such a course exists.
Thanks in advance for any suggestions,
Rich

(I just realised that I probably posted this in the wrong section - so feel free to move it Jamie - force of habit posting in this section!)

 
Posted : 27/07/2012 6:49 pm
(@taurean25)
Posts: 62
Trusted Member
 

i am currently looking at these courses

http//www.sans.org/security-training/course_sums/1237.pdf

http//www.myharddrivedied.com/data-recovery-training

 
Posted : 29/07/2012 8:45 am
(@rich2005)
Posts: 535
Honorable Member
Topic starter
 

Thanks taurean - looks like the sort of thing I'm after. I think the challenge will be convincing anyone to let me fly out somewhere for this! Doesn't look like there are any UK locations sadly.

 
Posted : 30/07/2012 2:26 pm
(@taurean25)
Posts: 62
Trusted Member
 

I believe they offer online versions of the course;however,
Because this course involves special equipment I would stress you to try and convince them to allow to take the course onsite or try to get many involved so the instructor comes to you.

Sorry about the grammar responded from my mobile

 
Posted : 30/07/2012 4:05 pm
(@armresl)
Posts: 1011
Noble Member
 

I've taken these courses in Canada, what specifically would you like to know Rich?

IMHO if they are offered via web, pass on it. Take the class in person. It costs just as much as a normal encase class, but it gives you a view of hard drives that you probably would never get otherwise. The instructors are Russian and you are not allowed to videotape or audiotape the presentation.

A major downside is that there wasn't enough time spent on actual situations you might incur, although they do have failed hard drives or all kinds, SMART Tables, P and G list errors, bad firmware,

once again IMHO the class is good I think it would benefit you in forensics and in data recovery, especially since PC-3k is the farthest thing away from push button I've ever seen. 1 very small mistake can ruin the drive

for e v e r Did I get that echoing canyon type feeling on the forever?

 
Posted : 31/07/2012 1:43 am
(@rich2005)
Posts: 535
Honorable Member
Topic starter
 

Thanks chaps. You're right, I'd definitely want a hands-on course.
Your paragraph
"A major downside is that there wasn't enough time spent on actual situations you might incur, although they do have failed hard drives or all kinds, SMART Tables, P and G list errors, bad firmware,"
is what worries me slightly though. As realistically if you're going to be attempting this on drives in important cases, you're not only going to want/need to the confidence you'll get it right first time every time, but be able to describe in detail what you did (for the court).

 
Posted : 31/07/2012 1:44 pm
Share: