Session Schedule

Loading Events

« All Events

  • This event has passed.
Sep 29

Session: The “Media Cache”: A Hidden Vault of Evidence in Seagate Hard Disk Drives

September 29 @ 8:00 pm - 9:00 pm EDT

Presented By: Ilia Lvovski


There is a hidden vault of evidence that could potentially contain up to 90GB of otherwise lost data in the “Media Cache” (MC) area of a Seagate drive. It is a dedicated area located on the outer part of a platter, used mainly with the new SMR (Shingle Magnetic Recording) Seagate drives. It is mainly used to store temporary data – a variation of cache storage. That data is copied into its permanent location later on.

This method allows Seagate drives to work faster and to provide a better user experience. With that, drives with MC are prone to many failures and errors.

The goals of my presentation are:

  1. Provide a brief introduction to the concept of MC in Seagate drives.
  2. Explain how MC works.
  3. Explain the types of failures a user can encounter when using an MC enabled drive and how to recognize them.
  4. Show the potential of MC – It stores up to 90GB of data, that can otherwise be lost. Even if the drive is entirely wiped/formatted, the MC can still contain the latest documents the user was working on.
  5. Using PC-3000 – An advanced data recovery tool from Ace Laboratories, I will show how to Access MC, How to repair drives with failed MC, and how to extract potential forensic evidence from the MC area.


September 29
8:00 pm - 9:00 pm EDT