Atola Technology

Clip Target Drive to Source Evidence Size

When you image data from a drive involved in an investigation case, and the target drive will be holding a 1:1 clone of evidence data, in many cases it is critical that the target drive’s capacity is identical to that of the source drive. Should there be a difference in size between the source and the target devices, their hashes will be different too.

However, if your SATA target drive has a larger capacity, you can limit its size to that of the source drive using Host Protected Area (HPA). It will make the sectors beyond this limit inaccessible to the hashing tools as well as the end user.

To do that:

  1. Go to Imaging category of the left-side menu and click Create New Session link
  2. In Preset line click the Show settings link.
  3. In Miscellaneous tab tick the box next to Limit target disk size to source size using HPA (SATA target ports only) option.

Enabling HPA

You can now proceed with the Imaging process by clicking Start Imaging button.

When Imaging is complete, you will see that target disk port now contains an HPA indicator, thus informing you that HPA has been enabled on this drive. There will also be a report created in the Case History.

Target Drive Port

This report will contain information about the time when HPA was enabled, a detailed device description and how this action was initiated. It will also indicate the initial max address as well as the current one.

HPA Report

Now you can calculate hashes on both disks to make sure they are identical.

Please note that enabling HPA is an option available only for SATA target drives.

Seghash – Open-source tool for segmented hashing

We have released Seghash, an open source tool that does two things:

Supported hash types: MD5, SHA1, SHA224, SHA256, SHA384, SHA512

Seghash is written in Go and released under MIT license. It works on Windows, Linux, and macOS. You can download the source and pre-built binaries from our Github account.

By releasing this open source tool we would like to encourage wide adoption of the segmented hashing algorithm by all software vendors who want to provide their users with a superior hashing option.

Segmented hashing tool

What is segmented hashing?

It is a hashing concept created by our company and implemented in Atola Insight Forensic.

With regular hashing, you get a single hash for the entire image.

With segmented hashing, you end up with many hashes of corresponding LBA ranges (chunks) of the image. The sum of these LBA ranges represents the entire image, just not necessarily in sequential order. By validating all hashes in a set, you can still prove that the entire image was not modified.

All segment hashes are saved in a CSV file with the following simple format:

Hash,start LBA,end LBA

Example:

75c92419e86ce82734ef3bbb781e6602,0,8388608
e2c7fc5264bae820e46c50b0502236d3,8388609,16777216
42718e48b5adb59563c98727cbce0619,16777217,25165824

… And so on until the last LBA.

 

Atola Insight Forensic 4.7 – Segmented hashing

Atola Insight Forensic 4.7 is released!

This release comes with the new hashing concept which protects you from damaged target images and works in parallel with the multi-pass imaging engine.

The full list of Atola Insight Forensic 4.7 changes can be found here: Atola Insight Forensic Changelog.

How is segmented hashing different from regular hashing?

With regular hashing, you get a single hash for the entire image.

With segmented hashing, you end up with many hashes of corresponding LBA ranges (chunks) of the image. The sum of these LBA ranges represents the entire image, just not necessarily in sequential order. By validating all hashes in a set, you can still prove that the entire image was not modified.

All segment hashes are saved in a CSV file with the following simple format:

Hash,start LBA,end LBA

Example:

75c92419e86ce82734ef3bbb781e6602,0,8388608
e2c7fc5264bae820e46c50b0502236d3,8388609,16777216
42718e48b5adb59563c98727cbce0619,16777217,25165824

… And so on until the last LBA.

Segmented hashes for multi-pass imaging

Conventional hashing algorithms prevent imaging source evidence in a non-linear way, which means no proper hash calculation when imaging damaged evidence drives. Enabling segmented hashing allows the use of multiple passes and more efficient handling of damaged drives, while still hashing all good areas.

Hashes are calculated only for the imaged regions, while all bad sectors are excluded from the calculation.

Segmented hashing in Imaging

Better resiliency

Another reason to use segmented hashes is to provide for better resiliency against target image data corruption. If your acquired evidence image is damaged at some point in the future, with regular hashes you will get a hash mismatch upon verification, and the entire image becomes useless, whereas with segmented hashes only one hash from a set becomes invalid.

Example – imaging with segmented hashing enabled

Here are imaging results with the link to segmented hashes file.

Imaging results with segmented hashes

Segmented hashes are saved in a CSV file with the simple “Hash,start LBA,end LBA” format:

Segmented hashes in CSV file

Example – verification of segmented hashes

There is a new operation added to Atola Insight – Verify Segmented Hashes. It is an automated way to take existing CSV files containing segmented hashes and verify all of them against the target image.

Let us take a closer look at the example to see how it works.

Step 1. First, let’s simulate a change of the evidence image. We can do so by selecting the target image and changing one byte at sector #35,000,000.

Change one byte in Disk Editor

 

Step 2. Now we go to Verify Segmented Hashes. Select the file with segmented hashes calculated during imaging and click Start.

Start segmented hash verification

 

Step 3. Hash verification is in progress. Here we see 18 segmented hashes checked. Hash for the interval that includes sector 35,000,000 is invalid.

Segmented hash verification in progress

 

Step 4. Hash verification finishes with the proper case report automatically created.

Segmented hash verification report

 

If you want to learn more about other 4.7 changes, visit this page: Atola Insight Forensic Changelog.

Where to buy

If you still do not have an Atola Insight Forensic and would like to place an order, this can be done directly via Atola Technology, or from a distributor near you:

http://atola.com/wheretobuy/

 

P.S. Dear customers, we appreciate your feedback and will take it into account when making changes to the product. Therefore, please feel free to write your thoughts or ideas as comments below.

 

Battery for Atola Insight Forensic

Today we are introducing our new product – Atola Battery.

The forensic world has been becoming more and more mobile. This is the reason why our team decided to come up with our first battery solution. It will help make your life less dependent on the availability of an electrical network when using Atola Insight Forensic. There are two main forensic use cases we see and want to emphasize.

  • Start image acquisition even when there is no electrical power.
  • Protect working DiskSense unit from power loss.

Atola Battery

Technical specifications

  • Work time: 3 hours 30 minutes, when imaging source HDD to target HDD with MD5 calculation
  • Standby time: more than 5 hours
  • Full charging: 2 hours
  • Capacity: 148 Wh
  • Input/output: 19V DC
  • Chemical: Lithium-ion
  • Dimensions: 7.5 x 7.3 x 2.1 in (192 x 185 x 54 mm)
  • Weight: 3.5 lb (1.6 kg)
  • LED charge indicators
  • Quiet mode switch
  • Сhaining with 1 or 2 additional batteries

Battery for Atola Insight Forensic

Battery chaining

Battery chaining is an exclusive feature from Atola Technology.

Imagine that you have two or three Atola batteries. All of them have standard DC inputs and outputs and are internally designed to be linked together. As a result, you will receive a cumulative effect—charges of all the batteries aggregate as a sum of distinct charges. This is how your battery work time can increase to up to more than 10 hours.

battery-chaining

Where to buy

The batteries are already in stock and ready to be shipped. You can purchase Atola battery following this link:

http://atola.com/wheretobuy/

Please contact our Atola Technology sales to receive more specific information:

Atola Insight Forensic 4.6 – Scripting

Today we are releasing Atola Insight Forensic 4.6.

The killer feature is AtolaScript language and the script execution engine. Now Atola Insight empowers you to perform the most sophisticated tasks by combining over 50 commands the way you want. Those include custom ATA commands, various commands to scan throughout the entire media to find specific data, read/write tests, and many others.

Full Atola Insight Forensic 4.6 change log is available here: Changelog.

Scripting

AtolaScript language is probably the simplest one you have ever seen. Scripts consist of one line instructions without semicolons. Conditions (if) as well as while, for, foreach loops are available in C# syntax. It is easy to run multiple scripts over different SATA, USB, SAS, IDE devices at the same time.

With all that being mentioned, the best thing about scripting is a wide variety of simple yet powerful commands designed by Atola team.

Custom ATA commands

Atola Insight Forensic has just become the first forensic solution that enables to execute any ATA command for any SATA/IDE drive.

There are three AtolaScript commands to run custom ATA commands depending on necessity of data-transfer or its direction:

  • Ata
  • AtaIn
  • AtaOut

A few examples:

Forensic scripts - Custom ATA commands

Forensic scripts - Custom ATA commands

Remark: Built-in Source port write-protection rejects any custom ATA command that can modify device state (i.e. perform a write operation).

 

Ultimate pattern/word/phrase search

The scripting system includes an internal search engine which is based upon Intel Hyperscan, a high-performance multiple regex matching library. It enables you to run searches everywhere including unallocated space with the help of three commands:

  • FindHEX
  • FindWords
  • Find

The commands work for all SATA, USB, SAS, IDE devices plugged into the DiskSense system.

FindWords

The command performs a search of words or phrases over the whole media space or specified region.  One the coolest FindWords features is that it attempts to match words/phrases in different encodings: ASCII, UTF-8, UTF-16LE, UTF-16BE. Now you can quickly perform a search in a multi-language environment.

In the example below you can see how FindWords outputs found matches for three words: Dubai, Quebec, Venice.

Forensic keyword search in Atola Insight

FindHEX

We have also implemented FindHEX for high-performance HEX pattern search.

The screenshot shows us how amazingly simple is to look for BitLocker volumes:

Forensic scripts - HEX search

Find

Find is a powerful way to run a regular expression search over specified disk region. You can find absolutely everything using the command: emails, GPS coordinates, phone numbers, home addresses, IPs, credit card numbers and so forth.

Forensic scripts - Find IP and MAC addresses via regex

 

Other handy AtolaScript commands

There are more than 50 commands available at your disposal. For instance, you can freely wipe, compare, hash drives or specific (or calculated) sector intervals.

Below I include a few more examples of what AtolaScript can do.

SMART attribute check

Forensic scripts - analyzing SMART

 

Data entropy calculation

Forensic scripts - Calculating entropy

 

Running benchmark test commands in parallel with scripts running on other devices

Forensic scripts - Multi-tasking

 

Friendly AtolaScript editor

The editor comes with a number of helpful UI options to turn scripting into a pleasant experience. Wherever these signs show up:

PlusEdit

 

one can click them and merely select a command looking at its description and sample code, and then edit command parameters with some additional help.

Forensic scripting command panel

Forensic scripting - Parameters panel

 

All other 4.6 changes are listed here: Atola Insight Forensic Changelog.

How to upgrade

Atola Insight Forensic 4.6 can be downloaded by all customers with an active software update subscription at no additional cost.

Where to buy

If you still do not have an Atola Insight Forensic and would like to place an order, this can be done directly via Atola Technology, or from a distributor near you:

http://atola.com/wheretobuy/

We still have an upgrade program for owners of old Atola Insight v3.x. Please contact our Atola Technology sales to receive more specific information: