Defcon 14 Speech Info

Defcon 14 Info

Animated Hard Drive Recovery
& Physical Rebuilds

presented by Scott Moulton &
Forensic Strategy Services, LLC.

This is a preview of a Animated Presentation for
Defcon 14 on August 4th, 2006 at 3PM. see:Schedule
If you can attend please do and stop by and say HI.

Use FIREFOX !!
On some computers IE does not
display the embedded Flash fonts.

Note: Please turn off pop-up
blockers for this presentation!

During the presentation look for this control panel in the
bottom right corner. Each time you push the Triangle you must
wait for the button to say "Play" over it (as below) before
pushing it again to continue to the next slide.

This will take 30 seconds to several minutes
to load depending on your bandwidth
once you click here! Be Patient...

IBM Hard Drive GMR Head Demo:

http://www.research.ibm.com/research/gmr.html

It's called the Giant Magnetoresistive effect.

Ten years ago, it hadn't even been discovered. But now, after intense and dedicated research and development, "giant magnetoresistance" -- or GMR for short -- makes its mass-market debut in IBM's record-breaking 16.8-gigabyte hard disk drive for desktop computers using a special GMR structure developed at IBM called a spin valve.

Most people don't give their hard drive a second thought -- until they run out of disk space. If this describes you, read on. Once you understand the beauty of the GMR/spin valve head, you will never feel the same way about your hard disk drive again.

MAKE YOUR OWN CLEAN ROOM - CHEAP
http://www.thenook.org/archives/3487.html

This is a cheap way to make a clean room, or rather glovebox for working on drives. Works well and will get the small jobs done.

When it is something important I usually use a clean box, usually called a glovebox. I added a link to the place I found the better instructions about creating one. Most common tech procedures apply here, but of course we are trying to do it cheap. In addition, when the platters spin, the air bearing created will usually spin off small debris. The drive was actually designed this way. However if you touch it, game over.

Software Links:

GetDataBack and DiskExplorer from http://www.Runtime.org
I have found that the tools from Runtime.org are extremely useful I use them often in my recovery work for NTFS and FAT Drives. While I do not work for Runtime nor am I being paid to offer anything, I contacted Runtime's Mr. Fesel to see if he would offer Defcon attendees a discount. He agree to a generous 30% Discount on Runtime's Product for Defcon Attendees. His message is:

"We would like to offer a 30% discount on all our software products for DEFCON attendees. Please ask the participants to mention the discount when ordering by using the promotion code "Defcon" in the comments section on the order form."

Ragnhild Fesel / Runtime Software http://www.runtime.org

I suggest that you try DiskExplorer for a hard drive that has sector damage as it will allow you to skip other data and go straight to the data you are looking for and extract it. GetDataBack is great if you can read the disk and have limited damage, but DiskExplorer is the real gem once you understand and have experience with it.

Other Useful Software I have used you may want to try.

Free Software Products:
The Supreme Commander of Free Products:
http://www.cgsecurity.org/wiki/TestDisk
http://www.cgsecurity.org/wiki/TestDisk_Download

Other Free Utilities:
http://dcfldd.sourceforge.net/
http://foremost.sourceforge.net/
http://www.partitionsupport.com/

Other Software Products:
R-Studio http://www.r-tt.com
Disk Commander http://www.winternals.com/
File Rescue 2.5 http://www.file-rescue.com
Undelete http://www.executive.com/
Hard Drive Mechanic http://www.highergroundsoftware.com/
http://www.highergroundsoftware.com/
Back2Life http://www.simtel.net/pub/pd/57588.html
DFSee/ http://www.dfsee.com
Fast File Recovery http://savemyfiles.com/fastfile.htm
Undelete 3.0 http://www.pcconnection.com/
Active UNERASER http://www.uneraser.com/undelete.htm
File Scavenge http://www.quetek.com/prod02.htm
File Restore http://www.winternals.com/
File Recover 2000 / http://www.filerecover.com
Undelete http://www.quantumsoft.co.uk/undelete.stm
Fast File Undelete http://www.dtidata.com/products_ff_undelete.asp
Data Recovery http://www.dtidata.com
For NTFS http://www.restorer2000.com/r2k.htm
Unformat http://www.unformat-unerase.com/#1

Forensic Strategy Services, LLC.
601B Industrial Court
Woodstock, Georgia 30189
ph 770.926.5588
fax 770.926.7089
email: Scott@ForensicStrategy.com