Atola Technology

Q&A during Techno Security and Digital Forensics Conference in San Antonio, Texas

We have just returned from Techno Security & Digital Forensics Conference, which took place on September 18-20 in San Antonio, Texas. Here are some of the questions asked at this event, which we would like to share with you, along with our answers to them. Should you have further queries, please don’t hesitate to write a comment below or send us a message here.

Question: Is there a reason why segmented hashing should be used to calculate hash of drives that are not damaged?

Answer: Yes, segmented hash allows you to verify evidence on the drive and its image even if either of them becomes damaged at some point in the future. With regular hashes you will get a hash mismatch upon verification and the entire image becomes useless. But with segmented hashing only a single hash value will become invalid while the rest of the image can still be validated.

 

Question: Is it possible to adjust imaging settings during imaging?

Answer: Yes, it is possible to do that by clicking Imaging settings link in the upper part of Insight’s window.

It is possible to adjust the following settings:

  • post-hash target device(s)
  • reverse direction on individual passes
  • disable read look-ahead
  • maximum number of consecutive power cycles
  • actions on consecutive read errors
  • compare source and target after imaging
  • power down source device when finished
  • read SMART information before the beginning and after the end of imaging
  • head selection
  • enable email status notification

However, certain options cannot be adjusted on the fly (e.g. number of passes and some of their preferences, hash method and type, filling errors with patterns etc.). If you need to make changes to these settings, pause the current session and click Add new session link located under the paused session, and adjust settings before clicking Start Imaging button.

 

Question: Can Insight achieve top imaging speeds when saving an image file to a location on a local network?

Answer: Insight’s 10Gbit Ethernet extension module allows imaging drives to a local network at top speeds as well as performing file recovery, compare, write from file.

However, a few minor adjustments need to be made:

  1. Update the 10GbE driver on PC workstation to the latest version
  2. Link 10GbE Ethernet extension module and 10GbE PC workstation LAN adapter with a Cat6 ethernet cable
  3. Open Windows Network and Sharing Center
  4. Click Change adapter settings link
  5. Locate 10GbE Ethernet card and open its Properties by clicking with the right mouse button
  6. Click Configure button
  7. Select Advanced tab
  8. Change Jumbo Packet value to 9014

Note that PC motherboard quality can have an impact on the resulting network performance and ensure that the PC drive is able to read/write at speeds above 300 MB/s.

 

Question: If an imaging session is paused, and then a new imaging session with the same source and target devices is created, will Insight image all sectors in range all over again?

Answer: No, Insight will only image the sectors that remained unimaged after the previous session.

e.g. if Insight has already imaged sectors 0 – 5,000,000 before imaging was paused, it will image sectors 5,000,001 onwards when imaging from the same source to the same target is started. However, if a different target device is connected, imaging will start from sector 0.

Thunderbolt extensions ready for shipping!

We are pleased to inform you that we have a bunch of Thunderbolt extension modules in stock that are ready to be shipped. The first extension modules are already on their way to the early birds who have placed their orders before they became available.

Thunderbolt extension module enables forensically sound imaging and other operations on all generations of MacBooks.

Supported interfaces and functionality

Thunderbolt extension enables Insight to work on all MacBooks with the following interfaces:

  • FireWire
  • Thunderbolt 2
  • Thunderbolt 3

With the help of Thunderbolt extension module you can perform such operations:

  • imaging
  • hash calculation
  • hash verification
  • comparing
  • media scan
  • file recovery

2016 and 2017 generations of MacBooks have non-extractable SSD drives, so the only way to handle such drives is by booting the MacBook in Target mode. In fact, with Insight’s Thunderbolt extension you can operate on all Macbooks the same way, hard drive extraction is no longer necessary.

Where to buy

To place an order, contact Atola Technology directly or a distributor near you:

http://atola.com/wheretobuy/

Please contact our Atola Technology sales to receive more specific information:

 

Exporting and importing cases from one computer to another

It is possible to transfer all or some of the cases stored in one Insight’s case management system to another one. The only requirement is that both computers have the same version of Insight installed.

Whenever cases need to be transferred from one computer to another one, start by exporting the cases.

1. Go to Cases category of the top level menu and click Export.

2. In the Export Cases window select folder where the cases should be stored, then select the cases you would like to be exported and click Save button.
3. The cases are now saved as a package in a zip file (with the default name Cases.Package.zip), which can later be copied to a different computer.

NB Whenever a case is exported, a record about it is added to the case’s history.

Importing cases

To import cases from a zip file into Insight on a different computer.

1. Click Import in Cases category of the top menu of Insight.
2. Click Browse icon and select path and name of the zip file.

3. Select some or all of the cases in the table and click Import button.

Please note that if there is a match between existing case numbers and the imported ones, Insight will prompt you to either cancel the import or save the case that causes the conflict as a copy.

Splitting an imaging session to separate targets

A situation may occur when multi-target imaging is paused to be continued later, but one or more targets become unavailable. The drive may need to be taken and used by another technician or broken, or the server with the image file may become unavailable. But you may need to finish the imaging to the remaining target asap to start working on the evidence.

It is for such cases that we have added the splitting imaging sessions functionality to the 4.9 release of Atola Insight Forensic.

With the source drive connected to Insight, go to Imaging category and view the details of the interrupted imaging session to several targets. If not all target drives and image files are available, it is impossible to simply resume imaging. However it is possible to split the previous imaging session into separate ones: one per each target. To do that click Split all sessions to separate targets link.

Once the session has been split, it is possible to resume imaging to each separate target by clicking Resume button in each target’s Imaging Session.

The resumed imaging session will skip all sectors imaged to the target within the previous session.

This way one can complete imaging to all targets at different times, as they become available.

NB Please note that if a target becomes unavailable during imaging, the process will automatically stop running, and you can try to either resume imaging to all targets, or split imaging sessions should it be necessary.

Multi-pass imaging of damaged drives

Atola Insight Forensic has a complex imaging functionality, which allows imaging even physically damaged hard drives, while avoiding further drive deterioration. Damaged drives require a complex imaging approach, which would balance thorough data extraction with forensics’ need in expediency and measured treatment of damaged media.

Most imagers have a linear imaging process, and whenever such imager encounters a bad sector on a drive, the process slows down drastically, which often causes the drive to freeze. To speed up imaging of damaged drives and maximize the amount of successfully retrieved data, Insight operates using a special imaging algorithm that provides deliberate timeout and block size control.

Using small block size pays off when you need to thoroughly retrieve maximum data from an unstable drive, but it also significantly slows down imaging process. What’s worse, such approach increases the possibility of causing further damage to the media. That’s why Insight’s multi-pass imaging engine uses large blocks with short timeouts on the first few passes, scheduling reads inside slow areas for later and then using the smallest block size on the last pass when fewer sectors are left to be read.

This technique helps achieve imaging speeds of 500 MB/sec in good areas of the drive, while approaching bad areas in the most gentle way possible and reaching unbeatable overall speed of disk duplication.

The best part is that Atola Insight Forensic will handle block sizes automatically, thus providing the best possible results in the shortest amount of time. This allows Atola Insight Forensic to be faster in virtually any job than any other data recovery or image acquisition tools commercially available.

Block sizes and timeouts are adjustable. However, the default settings of the passes are based on our decades-long experience in data recovery market to fit most problematic drives. Therefore, it is advisable to follow them, unless a particular drive requires specific settings.

On the first pass, Insight allows 1-second Timeout per block, and the Max read block size is set to 4096 sectors. The settings of the first pass allow smooth sequential imaging of all modern hard drives, whose media is sound. But when imaging damaged drives, these settings make Insight skip any areas that slow down reading and perform Jump on error by 1,000,000 sectors at a time. These settings ensure imaging data from the healthy areas of the drive at top speed, while forcing Insight to return to the problematic areas during the following passes, splitting such areas into smaller ones and allowing more time for reading the data within.

While Max read block size remains the same during the second and the third passes, the Jump on error is set to 20000 sectors and 4096 sectors respectively and slightly longer, 5-second Timeouts are allowed for attempted reading of the blocks.

On the fourth pass, both Jump on error and Max read block size are yet again reduced, this time to 256 sectors.

On the fifth pass Insight allocates 60-second Timeouts to read the Maximum block size of 256 with just 1-sector Jump on error. It is the last and the most scrupulous attempt to read the remaining bad areas of the drive.

After the final pass the Imaging Results report will appear to show the eventual number of errors on the drive and other detailed statistics.

When looking at the settings of the imaging passes, you will see the Reverse direction check boxes. With this function selected, Insight will approach skipped areas of the drive from the other side on any selected pass. This way Insight can get more data from a drive before entering a damaged zone, which needs to be concentrated on during the following passes.

Another option in the imaging pass settings, which is worth mentioning is Disable read look-ahead option. Most contemporary hard drives have read look-ahead functionality, which makes the drive read more blocks sequentially than requested by software. In good drives, this functionality helps the drive to operate faster by reading more data and caching them. But with bad drives, read look-ahead leads to bad areas being addressed more often, which slows down the process and may lead to a complete freeze of the drive. In such cases, disabling read look-ahead option is advisable.

Please note that when dealing with a damaged drive, we strongly recommend using Segmented hashing because this method supports multi-pass imaging and handling of bad sectors, and provides better resiliency against data corruption.

To read about the way Insight handles imaging of freezing damaged drives please follow this link.