- This event has passed.
Session: The “Media Cache”: A Hidden Vault of Evidence in Seagate Hard Disk Drives
September 29 @ 8:00 pm - 9:00 pm EDT
Presented By: Ilia Lvovski
There is a hidden vault of evidence that could potentially contain up to 90GB of otherwise lost data in the “Media Cache” (MC) area of a Seagate drive. It is a dedicated area located on the outer part of a platter, used mainly with the new SMR (Shingle Magnetic Recording) Seagate drives. It is mainly used to store temporary data – a variation of cache storage. That data is copied into its permanent location later on.
This method allows Seagate drives to work faster and to provide a better user experience. With that, drives with MC are prone to many failures and errors.
The goals of my presentation are:
- Provide a brief introduction to the concept of MC in Seagate drives.
- Explain how MC works.
- Explain the types of failures a user can encounter when using an MC enabled drive and how to recognize them.
- Show the potential of MC – It stores up to 90GB of data, that can otherwise be lost. Even if the drive is entirely wiped/formatted, the MC can still contain the latest documents the user was working on.
- Using PC-3000 – An advanced data recovery tool from Ace Laboratories, I will show how to Access MC, How to repair drives with failed MC, and how to extract potential forensic evidence from the MC area.