| June 10, 2019 |
ACE Lab Shared Its Expertise in Recovering Data at the Closed INTERPOL Digital Forensics Experts Group Meeting and InterFORENSICS 2019 |
This May, ACE Lab went to São Paulo, Brazil, to share its expertise in recovering data at the 4th closed INTERPOL Digital Forensics Experts Group Meeting which was held within the largest Forensic Sciences conference in Latin America - InterFORENSICS 2019. The events were conducted on May 21-24, 2019, in Frei Caneca Convention Center.
ACE Lab regularly attends the INTERPOL Digital Forensics Experts Group Meetings. This time was no exception and we gave the speech to over 100 forensic experts from 41 countries. The country members shared their experience in dealing with the latest challenges and developments in the digital forensics area.
Besides, our team took to the stage at the InterFORENSICS 2019 Conference as well. The presentation gathered a lot of attendees, indicating interest from digital forensics examiners, law enforcement agencies and academia members in Latin America. Roman Morozov provided his knowledge about the Media Cache (MC) in modern SMR Hard Disk Drives and its importance for forensics data recovery.
The thing is these drives use MC as an intermediate buffer to work with data. If the data portion transmitted via a single ATA command is less than half of the band, then the info will get into the Media Cache buffer before being written to the User Area of the HDD. Besides, as MC has a large volume (from 16 to 90GB), it may have data that user has been working on for a significant period of time – up to several months. Even if a criminal executes a complete erasing (e.g. filling with zeroes), it will be deleted on the User Area of the HDD, but Media Cache will still contain INFORMATION!
So, the session’s attendees found out how to view evidence stored in Media Cache and how to delete their own data from Media Cache for security reasons.
