Atola Insight Forensic

Key Features:

• Supports SATA, IDE, USB media including hard drives, USB flash devices, USB card reader, etc.
• Optional native Apple SSD support via a new PCIe adapter (2013-current Mac models)
• Support native 4K-sector USB devices (eg. iPod)
• In-depth Automatic HDD diagnostics
• Fastest in industry imaging speed up to 418 MB/s
• High-performance multi-pass imaging for damaged drives
• Imaging to multiple targets
• Show the speed of each drive involved in imaging to allow the user to locate bottlenecks
• Extraction of unknown ATA Passwords
• Sophisticated while user-friendly firmware recovery system
• File recovery for NTFS (all versions), Ext 2/3/4, HFS, HFS+, HFSX, ExFAT, FAT16, FAT32
• Improved searching in File Recovery – find by signature, size, attributes or hash
• Forensic data erasure methods including DoD 5220.22-M, Security Erase, NIST 800-88, Pattern Erase
• Hash calculation: MD5, SHA1, SHA224, SHA256, SHA384, SHA512
• File hash calculation in the background
• File hash export
• Network forensics via SSH (secondary Ethernet port for remote SSH access)
• Case management system prepares acquisition reports automatically
• Able to run multiple concurrent tasks over different hard drives, images, USB devices
• Can change IP via Insight > Modify DiskSense Unit IP menu
• Built-in write blocker
• User-friendly software interface
• Improved Help with a list of all keyboard shortcuts
• Equipped with 9 ports: one SATA source, one USB source, one IDE source, 3 SATA targets, 3 USB targets
• The small and light hardware unit

Supported Drives

Atola Insight Forensic supports all 1.8-inch, 2.5-inch, 3.5-inch IDE, SATA and USB hard drives, USB Flash media as well as SD, CompactFlash, and Memory Stick cards via a generic USB Card Reader.

Atola Insight Forensic can also work with the newest PCIe SSDs from Apple MacBooks (2013 – current models) via a proprietary Atola adapter.

Most functions of the Atola Insight Forensic will work with any hard drive or flash card with either IDE, SATA-1/2/3, or USB-1/2/3 interface (including those attached via adapters).

Diagnostics

Diagnose Unrecognizable HDD
Accurately diagnose hard drives that cannot be recognized or identified by other tools.

Automatic Checkup
Automatically diagnoses Circuit Board (PCB), motor, each head, media surface, firmware, partitions and file systems, identify specific errors and recommends steps for moving forward with HDD recovery and data extraction.

Media Scan
Displays read-speed for any range of sectors. The additional “Fast Scan” mode reads small select areas throughout the entire media to save time.

Current Monitoring
Has a Dual Oscilloscope that monitors the 5 volts and 12-volt currents being drawn by the hard drive in real-time, so that the user can track the electrical behavior of the hard drive throughout the entire data recovery process.

ATA Password Removal

• Automatically checks the hard drive’s security status
• Unlock the drive, or extract and view the password without unlocking
• Password is extracted in less than 2 minutes
• Unlocking or extracting has no impact on MD5 or SHA hash values

Firmware recovery

• Recognizes firmware corruption and repairs it with a single click for supported HDD models.
• For non-supported HDD models, recognizes firmware corruption and provides direct access to firmware files (modules) for expert technicians to manually repair the corruption. Firmware files can be quickly and easily edited, verified, replaced, or erased using the system’s smooth and user-friendly interface.
• Quickly and easily backup firmware files, for later use during the same case or future use in cases involving the same hard drive models.

HDD Duplication

Selective Head Imaging

Allows the user to identify damaged read/write heads so that he can adjust the imaging approach to start by reading from good heads and then going back to the damaged heads. This feature helps to avoid the need to swap heads.

Imaging Damaged Drives

Provide the best possible results in the shortest amount of time by its featured multi-pass imaging, imaging from good heads only, and other great capabilities.

Imaging to Multiple Targets

Images source media onto one, two, or three targets simultaneously.

Customize Every Step

• Completely customize the imaging process to suit special needs in each job.
• All parameters can be adjusted in a very simple way to fine-tune the process.

Copy to Image
Copy the source disk into an image file quickly and easily by selecting a storage location on the host PC and specify the image file size (put all data in a single image file or “chop” the data into a series of smaller chunks).

Data-Only Copy
Only copy occupied sectors to greatly save time and relieve strain on the source hard drive (supported file systems: NTFS (all versions), Ext 2/3/4, HFS, HFS+, HFSX, ExFAT, FAT16, FAT32).

Metadata-only Imaging
Select to image all sectors with metadata. Metadata-only imaging mode allows for imaging of specific files.

Image Specific Files
After imaging with “All sectors with metadata” finishes, select specific files in the File Recovery module and copy data of the selected files.

Automated Sector Analysis
When viewing sectors, known metadata is automatically parsed into a human-readable form.

Bad Sector Map
Creates a Bad Sector Map at the end of the duplication process to support the subsequent File Recovery module.

File Recovery

File Extraction Capabilities

• Finds and extracts file data and provide additional information regarding file status, for both good and damaged drives.
• Supports all versions of most popular operating systems: Windows, Mac OS X and Linux.

Status for Each File
Shows the status of each file, such as what percentage of the file was imaged without errors, which files are damaged and to what degree.