Atola Insight Forensic

It also offers complex yet highly automated data recovery functions on failing storage devices and provides utilities for accessing hard drives at the lowest level. Its sophisticated software is wrapped in a simple and effective user interface.

Designed for use both in the lab and in the field, Insight is developed by a team of industry renowned data recovery engineers in collaboration with law enforcement agencies and forensic experts from around the globe.

Atola Insight Forensic system includes:

• Insight Forensic software that runs on Windows PC
• DiskSense 2 hardware unit – released in July 2021
• Hardware extensions (optional)

Parallel imaging

Atola Insight is equipped with server-grade motherboard and CPU to sustain multiple imaging sessions at the top native speeds of the evidence drives, whether in good or bad condition.

• 3 simultaneous imaging sessions + multi-tasking
• 2 built-in 10Gb Ethernet ports
• Imaging session speed up to 500 MB/s
• E01, AFF4 or Raw target images created in the network or on target drives
• Up to 3 targets per imaging session
• Support of SATA, IDE, USB.
• Via extensions: Apple PCIe (2013 – recent models), NVMe and M.2 PCIe SSDs
• Built-in hardware write blocker for all source ports

Damaged drive support

All features are designed to support damaged media. In cases where other imagers stall or abort on media errors, Atola Insight can acquire a usable image. Types of damage supported: degraded or damaged heads, scratches on platters, logical errors, freezing drives, drives with worn-out magnetic layer.

• In-depth automated drive diagnostics
• Multi-pass imaging of damaged drives
• Automated reset of freezing media
• File recovery
• Bad sector recovery
• Segmented hashing for bad drive’s image verification
• HDD current monitoring for continuous diagnosis

Forensic feature set

• Unknown ATA password extraction
• Locate sectors – detect which files and partitions they belong to specified drive sectors
• Unknown ATA password extraction
• Hash calculation (linear and segmented): MD5, SHA1, SHA224, SHA256, SHA384, SHA512
• Wiping methods including DoD 5220.22-M, Secure Erase, NIST 800-88, Pattern Erase
• On-the-fly sector-level artifact finder
• Forensic file recovery for NTFS, APFS (with encrypted volumes), ext 4/3/2, ExFAT, HFS/HFS+, FAT32, FAT16
• Case management system automatically generates detailed reports
• Comparison of 1 drive against 3 drives or images
• Detection and lifting of HPA and DCO restricted areas
• SSD Trim

Workflow

1. Drive diagnostics

Atola imagers are the only products in both forensic and data recovery industries with the ability to automatically and accurately evaluate a hard drive’s health and pinpoint specific problems. Atola Insight automatically diagnoses the drive’s PCB, heads, media surface, firmware, and partitions, assesses imaging time, and creates a detailed report. The Diagnostics module helps you take informed decisions when getting down to imaging.

2. ATA password removal

Atola Insight automatically removes ATA passwords from hard drives in just 2 minutes. This sophisticated feature is executed with one click of a button. Whenever possible, the extracted password is displayed upon its removal.

3. Evidence drive imaging

Retrieving every fragment of data from a drive is a crucial to a forensically sound data acquisition. Atola Insight’s imaging system allows completely customizing imaging process to handle even damaged or unstable media.

It includes selective head imaging, which enables an individual imaging approach to each one based on the status of specific heads as identified by the Diagnostics module.

Not only does the imaging system copes with damaged drives, but also it runs multi-threaded sector-level analysis in the course of image acquisition:

• artifact search
• file signature detection
• entropy calculation

4. Forensic file recovery

Insight’s file recovery module is simple, intuitive, and effective. It integrates seamlessly with the imaging functionality and the Case Management system to retrieve data effectively.

Sector-level analysis with Artifact Finder and Locate Sectors helps find forensic artifacts in unallocated and hidden spaces that you could miss.

 
Part No:
AP-ATOLA-INSIGHTDS2

Extension Modules

DiskSense 2 hardware unit was designed with the ability to be enhanced with hardware add-ons in mind. There is a PCI Express port on its back panel, which is labeled as EXTENSION. It allows to connect any Atola hardware extension modules.

Extensions supported for DiskSense 2 are:

• M.2 SSD (for NVMe/SATA/PCIe)
• Thunderbolt
• Apple PCIe SSD

M.2 SSD extension for NVMe/SATA/PCIe

Only M key interface drives are supported with this extension. Here are the differences in M.2 NVMe, M.2 SATA and M.2 PCIe support:

Features	M.2 NVMe	M.2 SATA	M.2 PCIe
All Insight operations	Partial (see below)		Partial (see below)
Drive hotplug
Power management

Supported M.2 NVMe/PCIe SSD features:

• Imaging
• Diagnostics, media scan
• Damaged drive support
• Hash calculation and verification
• Wiping
• Write protection
• Device utilities: disk editor, media recovery, SSD trim, compare (with pattern, image file or drives) etc.

 
Part No:
AP-ATOLA-M.2

Apple PCIe SSD extension

This extension can process PCIe SSDs with custom proprietary M.2 interface found in Apple laptops:

• MacBook Pro, Late 2013 – 2015
• MacBook Air, 2013 – 2015

The following Insight operations and features are supported for the Apple drives:

• Imaging at 400 MB/s (24 GB/min)
• Diagnostics, media scan
• Damaged drive support
• Hash calculation and verification
• Wiping
• Write protection
• Device utilities: disk editor, media recovery, SSD trim, compare (with pattern, image file or drives) etc.

 
Part No:
AP-ATOLA-APPLEPCIe

Thunderbolt extension

Thunderbolt extension enables Insight to work on MacBooks with the following interfaces:

• FireWire
• Thunderbolt 2
• Thunderbolt 3, 2016 – 2017 models

No SSD removal is necessary: the extension allows connecting insight directly to a MacBook.

Insight supports the following operations and features on MacBooks when connected through Thunderbolt extension:

• Imaging
• Hash calculation and verification
• Write Protection
• Device utilities: file recovery, compare (with pattern, image file or drives) etc.

 
Part No:
AP-ATOLA-TBOLT