Atola Technology

Atola Insight Forensic 4.3 with Apple SSD support

We thank you all for supporting our product and proudly present Atola Insight Forensic 4.3 release. Record 170 fixes and improvements included in the new version. So hurry up to update your software!

Several major changes we want to focus your attention on are described below.

The full list of Atola Insight Forensic 4.3 changes can be found here: Atola Insight Forensic Changelog.

Apple PCIe SSD support

Insight 4.3 is the first version that is able to work with the newest PCIe SSDs from Apple MacBooks (2013 – current models). It can be made via new Atola adapter pluggable in the Extension port which is located on the DiskSense unit’s side with cooling fans:

Extension port for Apple PCIe SSD adapter

The new Insight version can perform SSD Trim, hash calculation, wiping, comparison, file recovery and of course imaging of the newest MacBook drives. By means of the new Atola extension adapter, Insight 4.3 can image such SSDs in a remarkably fast manner reaching 24 GB per minute speed.

Apple PCIe SSD

Hashes in File Recovery

All files of any target port have hashing enabled by default in File Recovery. Files hashes are calculated in the background for every file set found during reading device folders. Calculated hashes are automatically saved into a respective target case folder to avoid calculating twice the same file hash .

Insight > Preferences has now the File Recovery tab allowing to switch on/off Hash and other columns. It can separately be set up either for source port or target ports.

We have also added “Hash all files” button that may help in situation when it is necessary to calculate all hashes before performing file recovery.

Hashes

Advanced search options in File Recovery

Newly added file hashes can be specified in search conditions. Here’s the full list of search conditions added to Insight 4.3:

  • Date accessed
  • Date created
  • Date modified
  • File attributes (hidden)
  • First bytes (file signature)
  • Hash
  • Size

Each of these can be specified many times with different values and operation (more/less than, equals, between, etc.)

All new filters are grouped into a preset and can be exported to a file and imported from it. Thus, you can share search presets with your co-workers.

File Recovery search options

E01 image files

The new version supports imaging to one or more E01 files. So now Insight Forensic has three types of image files what might be beneficial in different situations:

  • E01 (EWF)
  • Growing
  • Preallocated

E01

Case port on the top panel

You can now search and open cases on a separate new Case port while source port is running some operation. It allows to work with your case history in a faster and more convenient fashion while multi-tasking.

Opened Case

 Specific support of new drive models

Recovery of unknown passwords is enhanced for such drive models as:

  • Hitachi: A9A3, CLA3, A7E6, A9E6 families
  • Toshiba DT
  • Samsung HD502IJ, HM160HI and similar models with certain firmware reading problems

Head-selection imaging and scanning is now possible for the following Toshiba drive families: MK, MQ, DT

Automatic Checkup head analysis become more robust after improvements made for specific WD, Hitachi and Toshiba drives.

 

All other major Insight Forensic 4.3 changes are listed here: Atola Insight Forensic Changelog.

How to upgrade

Insight Forensic 4.3 is available for download by all customers with an active software update subscription at no additional cost.

Where to buy

If you still do not have an Atola Insight Forensic and would like to place an order, this can be done directly via Atola Technology, or from a distributor near you:

http://atola.com/wheretobuy/

The extension adapter for Apple SSDs can be acquired directly via Atola Technology.

Pay attention we have an upgrade program for owners of old Atola Insight. Please contact our Atola Technology sales to receive more specific information:

 

P.S. Dear customers, your feedback is always welcomed, so please feel free to write comments below.

Atola Disk Recycler 2.0 with SAS support

We are introducing the new Atola Disk Recycler with full support for SAS drives. This release contains over 40 improvements and bug fixes.

Taking into consideration key features only, see how Recycler 2.0 is compared against the previous 1.8 version.

Atola Disk Recycler 2.0

Atola Disk Recycler 1.8

SATA drives Yes

Yes

SAS drives

Yes

No

High-performance report search

Yes

No

SAS support

We have created a new hardware system which has 4 ports with full support for both SAS and SATA drives.

New SAS and previous-generation SATA systems can be linked into a single network, both types will be properly recognized by the software.

SAS Disk Recycler 2.0

We added support of some SAS commands including custom ones like Sas, SasIn, SasOut:

sas-commands

Faster report search

Search report system was completely re-written in Disk Recycler 2.0. Now it doesn’t use an external database; instead, high-performance search index was added to give more responsive user experience when dealing with dozens of hardware units.

The search window has got the following improvements:

  • Smarter searches with wildcard support (see the screenshot below)
  • Pagination with search result count
  • Ability to export all found reports to CSV file

Report search in Recycler 2.0

All other significant Atola Disk Recycler 2.0 changes are listed here: Changelog.

How to upgrade software

Atola Disk Recycler 2.0 software is available on this page: Download

Where to buy Recycler units with SAS/SATA support

If you want to buy our newest Recycler SAS equipment, it can be done directly via Atola Technology, or from a distributor near you:

http://recycler.atola.com/pricing.html

 

Atola Insight Forensic 4.2 released

Atola Insight Forensic 4.2 with support of image files on target media and greatly improved performance has been released.

The new version includes over 120 fixes and improvements. The most valuable changes are addressed below.

Full Atola Insight Forensic 4.2 change log is available here: Atola Insight Forensic Changelog.

World’s fastest forensic imager

Insight Forensic 4.2 got a great speed-up for imaging and other operations even being run on weak laptops. See our latest benchmark published in the blog.

Image files on target devices

Image files can now be created on exFat-formatted Target hard drives. The specific exFat-formatting with large cluster size is necessary for receiving good performance during imaging process.

So now you can take a big HDD, attach it to DiskSense unit and create as many image files as drive capacity allows. This is how image file on target can be created in Insight Forensic 4.2.

Image File on Target 1

This is how Imaging source SSD to image file located on a target drive looks like.

Imaging source HDD to Image File on Target

Much better File Recovery user experience

File Recovery got lots of UI and performance improvements:

  • More compact and meaningful file list where you can include all file cluster/sector numbers
  • New cumulative filters
  • Browsing and recovery 400% speed-up for USB devices
  • Browsing and recovery 300% speed-up for ext4 partitions
  • Improved look & feel
  • Tracking of already recovered files: visual (green background) + filter (Recovered / Non-recovered)
  • Added keyboard shortcuts and improved navigation

File Recovery UI

Some other significant features

Imaging presets can now be exported into files and imported back:

Import-Export Presets

 

Two hashes can be simultaneously calculated during Imaging or Calculate Hash:

2 hashes at time

 

All other major Insight Forensic 4.2 changes are listed here: Atola Insight Forensic Changelog.

How to upgrade

Insight Forensic 4.2 can be downloaded by all customers with an active software update subscription at no additional cost.

Where to buy

If you still do not have an Atola Insight Forensic and would like to place an order, this can be done directly via Atola Technology, or from a distributor near you:

http://atola.com/wheretobuy/

Additionally, we have  an upgrade program for owners of old Atola Insight. Please contact our Atola Technology sales to receive more specific information:

 

Benchmark of the upcoming Atola Insight Forensic 4.2

In modern world hard drives are getting bigger and bigger. Amounts of data stored grow every day and demand more efforts from forensic experts. Thus, the performance of the data acquisition process becomes more and more critical.

One of the major improvements in the upcoming 4.2 release is a significant speed-up of core disk operations:

  • Imaging
  • Hashing
  • Comparison
  • Wiping

Here are the latest benchmark results:

Atola Insight Forensic 4.2

Atola Insight Forensic 4.1/4.0

Disk imaging 418

391

Disk imaging with MD5

418

385

Disk imaging with SHA-1

312

312

MD5 calculation  449

371

SHA-1 calculation

312

312

Comparison with pattern 458

374

Disk wiping 470

447

Values represent Megabytes per second (MB/s).

The tests were performed on this couple of Samsung 840 PRO drives.

Atola Insight Forensic Benchmark SSD Drives

Benchmark screenshots

Disk imaging

Insight 4.2 Imaging Speed

 

MD5 hashing

Insight 4.2 Hashing Speed

 

Comparison with pattern

Insight 4.2 Comparison Speed

 

Disk wiping

Insight 4.2 Wiping Speed

Tags:

Atola Insight Forensic 4.1

Today we have released Atola Insight Forensic 4.1.

Our main efforts were put on bug fixing to make Atola Insight Forensic more stable and reliable, and version 4.1 includes over 100 fixes and improvements. The most significant changes are addressed below.

Full Atola Insight Forensic 4.1 change log is available here: Atola Insight Changelog.

Imaging: new Metadata-only option

New Metadata-only imaging mode allows copying of absolutely minimum amount of data for file browsing to work, this allows for imaging of specific files.

All sectors with metadata

Creating imaging sessions from File Recovery

It is now possible to create an imaging session that would include sectors of specific files. It works perfect together with the new ‘All sectors with metadata’ option in Imaging. So here’s the most quick scenario to image a pack of files:

  1. Start imaging with ‘All sectors with metadata’ selected.
  2. After imaging finishes, switch to target port and go to File Recovery.
  3. Find files you need to image and select them.
  4. Click ‘Image selected…’ button.
  5. Start new imaging session that copies data of the selected files.
  6. Re-visit File Recovery and see the files are 100% copied.

 

Automated sector analysis

Automated sector analysis was built in to Disk Editor and Imaging. When viewing sectors, known metadata is automatically parsed into a human-readable form.

Metadata types supported:

  • Master boot record
  • NTFS boot sector
  • NTFS file record
  • NTFS index
  • HFS volume header
  • HFS plus B tree header
  • ext super block
  • exFAT boot sector
  • FAT32 boot sector
  • FAT boot sector

File Record

File Record Parsed

 

Watch this screencast to see how you can analyse copied data right during Imaging:

 

Imaging presets

Imaging settings can now be saved into custom presets. Export/import operations will be added in Insight v.4.2

Imaging Preset

 

How to order

You can order Atola Insight Forensic from us directly, or from a distributor near you:
http://atola.com/wheretobuy/