PC-3000 Forum

Working in a forensic research environment, I've been tasked with acquiring the Service Area of a F3 Seagate HDD. I would like to 'image' the Service Area for head 0,1,2,3 etc (All Service Areas that can be read or written to). I know this is bespoke seagate data, but what I'm looking for are common user files that may have been placed in this area to evade standard forensic detection. I know I have the ability to read individual firmware modules but ideally I'd like to be able to request and copy every Service Area block address per head, creating something similar to a dd image, which I can then further investigate independently. Is there a way of using PC3000 to achieve this task. i.e. copy out the Service Area sectors per head.

Secondly, how can I verify that every address space has been copied. Is there a way to calculate the size of the Service Area for each individual platter/head.

Thanks.

Investigator

Hello ISRG,

Seagate utility doesn't have the ability to read all Service Area right now.
Developers looking into this function, but seems like this feature will not be added at next version.

Anyway if you know terminal commands you will be able to read all Searvice Area by COM port in PC3000 too.

Hi Dima,

I tried to PM you but it keeps getting stuck in outbox?

I know this will not be a common feature most customers want. I am looking to do this manually via the terminal connection using F3 commands. I work in Forensics and this is an issue for us now. From our research we believe it is possible to obtain all the ABA address for each head SA. Making a map for us to copy (sector map). Next, we need to request these addresses to read out the contents in a file (dd/raw file). Then we can data carve for common file types to answer our question of integrity. I know Deepspar have done work on this..

Can you please provide us some assistance in using the correct commands to achieve this?

Thanks!

Hello,

I think it is possible to add this function in utility.
Please write me to ts@acelab.ru