Atola Technology

Imaging speed improvements preannounced in Atola Insight Forensic 4.5

We would like to share the newest speed achieved by the revamped Imaging engine. It will be shipped within 4.5 software update in May.

Total imaging performance was significantly improved during last 4 months. Just take a look at 503MB/s imaging speed in the screenshot below. It is more than 30 GB per minute.

imaging-speed

 

The new Imagine engine empowers you to image 256GB Samsung 850 Pro just in 8.5 minutes!

256GB imaged in 8.5 minutes

Atola Insight 4.4: 10Gbit Ethernet, SAS, M.2 extensions

Atola Insight Forensic 4.4 is ready for download now!

The newest version got 3 new extension modules supported, 130+ improvements and bug fixes. In particular, we have been working really hard on the major new features addressed below.

Full Atola Insight Forensic 4.4 change log is available here: Changelog.

SAS extension module

SAS extension module was designed to diagnose SAS drives and acquire images from them. It is really easy in use. As any other extension module, it should be plugged in the Extension port located on the DiskSense unit. Then you connect a SAS drive to it and simply start working.

Atola Insight Forensic 4.4 supports damaged SAS drives, senses currents during Automatic Checkup, provides short circuit and overvoltage protection as well as write protection.

Forensic SAS extension module

Forensic SAS drive extension module

 

10 GBit Ethernet extension module

The 10GBit Ethernet module is primarily targeted to accelerate data transfer speed between PC and DiskSense system. It speeds up imaging source drive to an image file from 100 MB/s to 300-400 MB/s. File recovery from SATA/USB drives receives the same level of acceleration.

The extension module works via 10G Cat6 copper cable with RJ45 (8P8C) interface for connection.

There are some tips in the manual helping to get optimum performance. To open the manual, launch Atola Insight Forensic 4.4 and press F1 .

Forensic 10 GB extension module for Atola Insight

Forensic 10GB extension module

 

 M.2 PCIe/SATA extension module

This extension module allows to work with both PCIe and SATA drives with M.2 connector. It is another type of source drive you can select in Atola Insight. The extension supports damaged drives, write protection and lots of Atola Insight Forensic operations.

M2 PCIe Sata- SSD extension

 

M2 PCI SATA SSD extension moduleYou can also find more information about this and other Atola Insight extension modules.

Revamped E01 image file support

We totally revamped E01 (Encase) image file support in order to make it faster and support Pause/Resume feature in Imaging. This also helped to increase compatibility of E01 files produced via Atola Insight with some third-party forensic tools which are not tolerant to E01 metadata deviations.

Imaging Pause/Resume support for E01 image files

White/Black hash lists

New Atola Insight version allows to import text files containing huge lists of file hashes. Those can be treated as white or black hashes. The idea behind these types is simple:

  • White hash term stands for a known good file created by known software.
  • Black hash means some known bad file. It could be a malware, hacking script, hidden illicit data file.

Having hash lists imported to Atola Insight DB,  File Recovery analyzes every calculated file hash against the database. If file hash belongs to either white or black hash list, special marks are shown on the left of file hash values:

  • Files having white hashes detected are marked with ticks.
  • Files having black hashes are marked with warning triangles.

On top of that, White/Black hash list filtering is supported throughout whole File Recovery. It is available as ‘Hash list’ condition in Search window, so one could quickly find all files with unknown hashes (those that are not white or black) and begin working on them.

File browsing filters have also received three new options: White, Black, Unknown. Here is the example below. You can see Linux partition with /usr/bin folder opened that normally contains more than 1300 files.

Case 1. No filters applied

All files are shown. The ticked files are good ones since they have white hashes (marked with ticks).

All files are shown without filtering

Case 2. Black and Unknown hash list filters applied

All good files having White hash are filtered out. Thus, we just see two files which are valuable for further analysis. Hash of malicious.file was found in the black hash list. shady.me is not marked which means it could contain some interesting data inside.

File Recovery black and unknown hashes interested

All other 4.4 changes are listed here: Atola Insight Forensic Changelog.

How to upgrade

Atola Insight Forensic 4.4 is available for download to all customers with an active software update subscription at no additional cost.

Where to buy

If you still do not have an Atola Insight Forensic and would like to place an order, this can be done directly via Atola Technology, or from a distributor near you:

http://atola.com/wheretobuy/

The extension modules can be acquired directly via Atola Technology.

We still have an upgrade program for owners of old Atola Insight v3.x. Please contact our Atola Technology sales to receive more specific information:

 

Tags:

How to resolve DiskSense / HASP connection issues

DiskSense hardware system includes an internal HASP USB dongle. It contains unique activation and subscription information.

Having more than one DiskSense system in your network may result in HASP-related conflicts. These conflicts usually manifest as “Too many connections” or “Cannot located DiskSense unit” errors. The issue is caused by behavior of the HASP discovery system which by default picks a random HASP dongle on the network. In other words, one Atola Insight Forensic instance may establish the connection with one DiskSense system, however it will “use” the HASP dongle of another (random) system available on the network.

How to resolve multiple HASP connection issues

We would like to share the solution with you. HASP discovery system offers a web administration tool where one can easily set up IP filter specifying HASP dongle search locations.

  1. Access the URL with your browser: http://localhost:1947
  2. Click ‘Configuration’ link in the left side menu
  3. Click ‘Access to Remote License Managers’ tab
  4. Untick ‘Broadcast Search for Remote Licenses’ checkbox
  5. Enter specific DiskSense IP you want to be connected to
  6. Click ‘Submit’

After you perform the actions, the final screen should look like like this:

Note: 192.168.0.200 is used as an example.

hasp-discovery

Tags: , , ,

Atola Insight Forensic 4.3 with Apple SSD support

We thank you all for supporting our product and proudly present Atola Insight Forensic 4.3 release. Record 170 fixes and improvements included in the new version. So hurry up to update your software!

Several major changes we want to focus your attention on are described below.

The full list of Atola Insight Forensic 4.3 changes can be found here: Atola Insight Forensic Changelog.

Apple PCIe SSD support

Insight 4.3 is the first version that is able to work with the newest PCIe SSDs from Apple MacBooks (2013 – current models). It can be made via new Atola adapter pluggable in the Extension port which is located on the DiskSense unit’s side with cooling fans:

Extension port for Apple PCIe SSD adapter

The new Insight version can perform SSD Trim, hash calculation, wiping, comparison, file recovery and of course imaging of the newest MacBook drives. By means of the new Atola extension adapter, Insight 4.3 can image such SSDs in a remarkably fast manner reaching 24 GB per minute speed.

Apple PCIe SSD

Hashes in File Recovery

All files of any target port have hashing enabled by default in File Recovery. Files hashes are calculated in the background for every file set found during reading device folders. Calculated hashes are automatically saved into a respective target case folder to avoid calculating twice the same file hash .

Insight > Preferences has now the File Recovery tab allowing to switch on/off Hash and other columns. It can separately be set up either for source port or target ports.

We have also added “Hash all files” button that may help in situation when it is necessary to calculate all hashes before performing file recovery.

Hashes

Advanced search options in File Recovery

Newly added file hashes can be specified in search conditions. Here’s the full list of search conditions added to Insight 4.3:

  • Date accessed
  • Date created
  • Date modified
  • File attributes (hidden)
  • First bytes (file signature)
  • Hash
  • Size

Each of these can be specified many times with different values and operation (more/less than, equals, between, etc.)

All new filters are grouped into a preset and can be exported to a file and imported from it. Thus, you can share search presets with your co-workers.

File Recovery search options

E01 image files

The new version supports imaging to one or more E01 files. So now Insight Forensic has three types of image files what might be beneficial in different situations:

  • E01 (EWF)
  • Growing
  • Preallocated

E01

Case port on the top panel

You can now search and open cases on a separate new Case port while source port is running some operation. It allows to work with your case history in a faster and more convenient fashion while multi-tasking.

Opened Case

 Specific support of new drive models

Recovery of unknown passwords is enhanced for such drive models as:

  • Hitachi: A9A3, CLA3, A7E6, A9E6 families
  • Toshiba DT
  • Samsung HD502IJ, HM160HI and similar models with certain firmware reading problems

Head-selection imaging and scanning is now possible for the following Toshiba drive families: MK, MQ, DT

Automatic Checkup head analysis become more robust after improvements made for specific WD, Hitachi and Toshiba drives.

 

All other major Insight Forensic 4.3 changes are listed here: Atola Insight Forensic Changelog.

How to upgrade

Insight Forensic 4.3 is available for download by all customers with an active software update subscription at no additional cost.

Where to buy

If you still do not have an Atola Insight Forensic and would like to place an order, this can be done directly via Atola Technology, or from a distributor near you:

http://atola.com/wheretobuy/

The extension adapter for Apple SSDs can be acquired directly via Atola Technology.

Pay attention we have an upgrade program for owners of old Atola Insight. Please contact our Atola Technology sales to receive more specific information:

 

P.S. Dear customers, your feedback is always welcomed, so please feel free to write comments below.

Atola Disk Recycler 2.0 with SAS support

We are introducing the new Atola Disk Recycler with full support for SAS drives. This release contains over 40 improvements and bug fixes.

Taking into consideration key features only, see how Recycler 2.0 is compared against the previous 1.8 version.

Atola Disk Recycler 2.0

Atola Disk Recycler 1.8

SATA drives Yes

Yes

SAS drives

Yes

No

High-performance report search

Yes

No

SAS support

We have created a new hardware system which has 4 ports with full support for both SAS and SATA drives.

New SAS and previous-generation SATA systems can be linked into a single network, both types will be properly recognized by the software.

SAS Disk Recycler 2.0

We added support of some SAS commands including custom ones like Sas, SasIn, SasOut:

sas-commands

Faster report search

Search report system was completely re-written in Disk Recycler 2.0. Now it doesn’t use an external database; instead, high-performance search index was added to give more responsive user experience when dealing with dozens of hardware units.

The search window has got the following improvements:

  • Smarter searches with wildcard support (see the screenshot below)
  • Pagination with search result count
  • Ability to export all found reports to CSV file

Report search in Recycler 2.0

All other significant Atola Disk Recycler 2.0 changes are listed here: Changelog.

How to upgrade software

Atola Disk Recycler 2.0 software is available on this page: Download

Where to buy Recycler units with SAS/SATA support

If you want to buy our newest Recycler SAS equipment, it can be done directly via Atola Technology, or from a distributor near you:

http://recycler.atola.com/pricing.html