Erasing data on destination drives guarantees accuracy of the imaged data and helps verify that the drive has no errors. In the course, all sectors are overwritten with the help of selected pattern or method.
When you need to prepare multiple hard drives for imaging, Insight’s multitasking capabilities enable you to do so much faster by launching Erase/Fill on multiple drives simultaneously, including those connected to the source port.
To wipe the drive connected to the source port, remember to switch off write protection on the port so that the indicator above the switch is off and there is a notification right below the port bar saying Note: Write protection of currently attached device is OFF (see the picture below).
Then follow these steps:
1. Under Device Utilities select Fill or Erase.
2. Select Fill method among the wide range of options and click on Next button.
3. Select the range of sectors to be erased on the drive and click on Start Fill / Erase button.
4. Finally, confirm that you want to erase data on the disk in the pop-up window.
To run a concurrent Fill/ Erase process on another drive, click on the +(plus) icon in the port bar and select a drive connected to a Target port:
Then repeat the same steps to launch the process on this device:
By following the same steps you can wipe data from one source drive and three target drives, all at the same time, as shown in the picture below.
This ability to perform Fill/Erase on multiple drives makes Insight exceptionally useful for forensic units dealing with multiple cases, where evidence acquisition is an ongoing activity.
When Atola Insight Forensic performs Imaging, it approaches bad sectors in the most gentle yet thorough way with high overall speed. But most importantly, Insight is unbeatable at imaging severely damaged drives, while providing all the necessary tools for evidence verification and proper data storage formats. Insight’s ability to succeed even with the drives that freeze in the course of imaging makes it indispensable for forensic specialists.
So why do damaged drives freeze?
When a drive receives and runs a Read sectors command, and comes across a physically or logically damaged sector, the device is unable to return a good result. Therefore it goes into Retry mode, repeatedly attempting to retrieve data from the damaged area.
However, often the drive is unable to read data from the damaged sectors and the Retry mode can last for a very long time before it decides to give up on a particular sector and return an Error.
How does Insight handle this issue?
If Insight simply waited for each Read sectors command to be completed:
it would take ages to get an Image of a drive with numerous errors;
it could cause the drive to slip into complete freeze;
in the worst-case scenario, further damage could be caused to the data on the drive.
For these reasons, Insight issues a Reset command whenever a drive attempts to read a block of sectors for longer than allowed by the pre-configured Timeout. Reset is a device interface operation, using which Insight (the host) stops the previously sent Read sectors (or any other) ATA command so that Insight continues imaging from the next planned block on the drive.
If the device is still running Read Sectors command, even after Reset attempt, Insight will wait 3 seconds and perform another Reset command. At the moment of the second Reset, a new entry will appear in the Imaging Log reading Device hangs while reading block X – Y.
If 20 seconds after the second Reset, the drive has not been able to abandon the current block, Insight will perform Power cycleby forcibly cutting power to the drive for 5 seconds. At this point Insight will add two entries to the log: Performing power cycle… (when the power is cut off) and Waiting for the device to become ready… (when the power is switched back on).
Should Power cycle prove successful and the drive become ready to accept the next command, there will be a final log entry for this problematic block of sectors saying: Cannot read block of data at X – Y (Timeout).
If Power cycle is ineffective, it means that the drive is still in Busy state that prevents it from becoming ready to run the next command. After that, Insight will make one or more additional power cycles. In Insight’s default settings the Max consecutive Power Cycles option is set to five. Should all five Power cycles be unsuccessful, Imaging will be automatically terminated. It can be resumed afterwards, and Insight will continue to image all remaining sectors.
While users are able to change the default maximum numbers of Resets and Power cycles, these are set based on our decades-long experience and balance the need of data retrieving with the risk of further data loss.
NB If prior to Imaging, you applied Change Max Address temporarily (until power cycle) option, the Power cycles performed in the course of Imaging will not affect it. The Host Protected Area will remain accessible throughout the Imaging process. Insight will temporarily remove HPA max address restriction after each Imaging-related Power cycle.
The same is true for Reset Password until power cycle option. Insight will keep the password reset throughout the Imaging process, without regard to the Power cycles applied.
Password recovery now works on new Hitachi hard drives including Hitachi HCxxxxxxxA7A3xx, HTxxxxxxxA9E3xx, HTxxxxxxxA9E6xx. The latter is used in Sony PlayStation PS4 Pro gaming consoles, which was launched worldwide in November 2016.
Consolidation of segmented hashes
For imaging sessions that include calculation of segmented hashes, we created a feature enabling you to consolidate the hashes calculated during each separate imaging session. To perform consolidation, click Export consolidated hashes for all sessions:
In the pop-up window, you will be asked to select the folder, where the file with consolidated hashes will be saved. Click OK button in the dialog box pop-up window, and all the separate .csv files s that contain segmented hashes from previous imaging session will be consolidated into one file.
SMART table attributes
Insight automatically saves a drive’s SMART table before and after completion of imaging. Quite often there are differences in the two SMART tables. From now on, the changes will be highlighted in the After Imaging table to draw attention to the attributes that have changed.
Power down source device upon completion
A similar option was available for SATA target drives involved in long-running operations (Calculate Hash, Verify Segmented Hashes, Fill/Erase, Comparing, Media Recovery, Write From File). This new option can work on all source devices that support power management. To activate it:
Go to Insight category in the top-level menu
In the Preferences window go to Miscellaneous tab
Tick Power down source device upon completion
Click Apply button
Please note that for Imaging you can still use the Power down source device when finished option located in the Miscellaneous tab of the Imaging settings.
Custom signature tag field
Insight allows you to add custom signatures to the already available 392 file signatures. Before this release, there were three columns in the table with the additional signatures:
Name, Bytes in Hex codes, Extension
Now there is a new column named Tag. This column is optional, and it enables you to mark specific (or all) additional signatures with any text in the Tag field to make them easily trackable.
On top of that, multi-column sorting in Found File Signatures table is now way more convenient. There is no need now to press any keys: just click on any category (first click = sort ascending; second click = sort descending; third click = no sorting) to make it the primary sorting category and then on another one for sorting by secondary category.
February 22nd, 2017 Author: Yulia Samoteykina No Comments
With each passing year, speed becomes a yet bigger issue for forensic specialists: while the capacity of hard drives grows exponentially, their speed does not keep up. A common 4TB drive’s speed constitutes up to 200 MB/s or 12 GB/min, which translates to more than 5 hours of imaging. And it may take prohibitive amounts of time to image a drive with damaged zones. Therefore, the ability to simultaneously run different operations on several devices is more vital than ever.
To provide users with greater productivity, Atola Insight Forensic’s high-capacity multi-core CPU supports up to 15 concurrent tasks, that can be assigned to different drives or image files.
You can start Imaging process from a Source drive to one or multiple Target drives and/or image files. Then you can click on the Plus icon and open another target drive to start another operation.
For example, you can launch Fill/Erase on this Target drive to get it ready for the next Imaging session:
It is also possible to Calculate Hash on yet another Target drive:
Other long-running operations you can perform simultaneously include:
Verifying Segmented Hashes
Scripting (e.g. search files, files types, words, phrases or patterns, specific information type like email address, telephone, address, GPS coordinates etc.).