Atola Technology

Atola Insight Forensic 4.5 release

Atola Insight Forensic 4.5 is released!

We put a great deal of effort on implementing the new imaging engine to improve image acquisition stability and performance at the same time. There are quite many changes to other parts of the product as well. In total, our internal issue tracking system has a record number of almost 250 tasks completed for 4.5 release.

Full Atola Insight Forensic 4.5 change log is available here: Version Log.

Improved performance

Atola Insight 4.5 benchmarks show speed-up of core disk operations (all numbers are MB/s):

Atola Insight Forensic 4.5

Atola Insight Forensic 4.4

Imaging to SATA target 500

418

Imaging to raw image file (1Gb network) 120

110

Imaging to E01 file with MD5 and SHA1 (1Gb network)

118

85

Imaging to compressed E01 file

57

30

MD5 calculation

482

 449

The tests were performed using two drives of the following model: Samsung SSD 850 PRO 256GB EXM02B6Q.

 

New features in Imaging

The revamped Imaging engine introduces some smart and beautiful features. For example, it will now automatically clear ATA password and HPA on-the-fly after power cycle if they were temporarily removed (only temporary removal is supported for write protected source media).

Password reset

 

Imaging progress bar is included in every resulting case report to visualize cloned data.

Imaging progress bar

 

There is a new imaging setting “Stop hashing on first error”.  It calculates and stores a correct hash for all sectors preceding the first read error on an evidence drive.

Stop hashing on read error

 

We improved logging verbosity during imaging. You can see the most noticeable change when ‘All sectors with data/metadata’ is selected. In that case the imaging log will contain information about found partitions.

Found partitions

 

Last but not least, Atola’s new media map manager offers better user experience to select custom partitions and ranges for imaging.

Imaging media map manager

 

New preferences

There are two new options in Miscellaneous tab that need to be explained:

  • Power down SATA target device when operation finished
  • Enable Target HEX viewer during Imaging

Image 008

Power down SATA target device when operation finished

Before Atola Insight 4.5, all long-lasting operations (Imaging, Calculate Hash, Fill or Erase, Comparing) performed on Target ports have been followed by a mandatory power off. This is mainly done for safety reasons of target drives containing imaged source data. Put it another way, it is not necessarily expected under some circumstances. For instance, when you were wiping a drive with Fill or Erase and are instantly going to start Imaging afterward. A power cycle is not needed then. In that case, it is convenient to disable the option.

Enable Target HEX viewer during Imaging

The significance of disabling Target HEX viewer during Imaging arises when source imaging data is critically sensitive so that software user must not see it. In such a case Imaging runs from a source drive to a target drive having both plugged into the DiskSense system. Having Target HEX viewer disabled, we guarantee that source bytes flow will go through the DiskSense system only and will not enter the network and the host PC.

 

All other 4.5 changes are listed here: Atola Insight Forensic Changelog.

How to upgrade

Atola Insight Forensic 4.5 can be downloaded by all customers with an active software update subscription at no additional cost.

Where to buy

If you still do not have an Atola Insight Forensic and would like to place an order, it can be done directly via Atola Technology, or from a distributor near you:

http://atola.com/wheretobuy/

We still offer an upgrade program for owners of old Atola Insight v3.x. Please contact our Atola Technology sales to receive more detailed information:

 

Imaging speed improvements preannounced in Atola Insight Forensic 4.5

We would like to share the newest speed achieved by the revamped Imaging engine. It will be shipped within 4.5 software update in May.

Total imaging performance was significantly improved during last 4 months. Just take a look at 503MB/s imaging speed in the screenshot below. It is more than 30 GB per minute.

imaging-speed

 

The new imaging engine empowers you to clone 256GB Samsung 850 Pro just in 8.5 minutes!

256GB imaged in 8.5 minutes

Atola Insight 4.4: 10Gbit Ethernet, SAS, M.2 extensions

Atola Insight Forensic 4.4 is ready for download now!

The newest version got 3 new extension modules supported, 130+ improvements and bug fixes. In particular, we have been working really hard on the major new features addressed below.

Full Atola Insight Forensic 4.4 change log is available here: Changelog.

SAS extension module

SAS extension module was designed to diagnose SAS drives and acquire images from them. It is really easy in use. As any other extension module, it should be plugged in the Extension port located on the DiskSense unit. Then you connect a SAS drive to it and simply start working.

Atola Insight Forensic 4.4 supports damaged SAS drives, senses currents during Automatic Checkup, provides short circuit and overvoltage protection as well as write protection.

Forensic SAS extension module

Forensic SAS drive extension module

 

10 GBit Ethernet extension module

The 10GBit Ethernet module is primarily targeted to accelerate data transfer speed between PC and DiskSense system. It speeds up imaging source drive to an image file from 100 MB/s to 300-400 MB/s. File recovery from SATA/USB drives receives the same level of acceleration.

The extension module works via 10G Cat6 copper cable with RJ45 (8P8C) interface for connection.

There are some tips in the manual helping to get optimum performance. To open the manual, launch Atola Insight Forensic 4.4 and press F1 .

Forensic 10 GB extension module for Atola Insight

Forensic 10GB extension module

 

 M.2 PCIe/SATA extension module

This extension module allows to work with both PCIe and SATA drives with M.2 connector. It is another type of source drive you can select in Atola Insight. The extension supports damaged drives, write protection and lots of Atola Insight Forensic operations.

M2 PCIe Sata- SSD extension

 

M2 PCI SATA SSD extension moduleYou can also find more information about this and other Atola Insight extension modules.

Revamped E01 image file support

We totally revamped E01 (Encase) image file support in order to make it faster and support Pause/Resume feature in Imaging. This also helped to increase compatibility of E01 files produced via Atola Insight with some third-party forensic tools which are not tolerant to E01 metadata deviations.

Imaging Pause/Resume support for E01 image files

White/Black hash lists

New Atola Insight version allows to import text files containing huge lists of file hashes. Those can be treated as white or black hashes. The idea behind these types is simple:

  • White hash term stands for a known good file created by known software.
  • Black hash means some known bad file. It could be a malware, hacking script, hidden illicit data file.

Having hash lists imported to Atola Insight DB,  File Recovery analyzes every calculated file hash against the database. If file hash belongs to either white or black hash list, special marks are shown on the left of file hash values:

  • Files having white hashes detected are marked with ticks.
  • Files having black hashes are marked with warning triangles.

On top of that, White/Black hash list filtering is supported throughout whole File Recovery. It is available as ‘Hash list’ condition in Search window, so one could quickly find all files with unknown hashes (those that are not white or black) and begin working on them.

File browsing filters have also received three new options: White, Black, Unknown. Here is the example below. You can see Linux partition with /usr/bin folder opened that normally contains more than 1300 files.

Case 1. No filters applied

All files are shown. The ticked files are good ones since they have white hashes (marked with ticks).

All files are shown without filtering

Case 2. Black and Unknown hash list filters applied

All good files having White hash are filtered out. Thus, we just see two files which are valuable for further analysis. Hash of malicious.file was found in the black hash list. shady.me is not marked which means it could contain some interesting data inside.

File Recovery black and unknown hashes interested

All other 4.4 changes are listed here: Atola Insight Forensic Changelog.

How to upgrade

Atola Insight Forensic 4.4 is available for download to all customers with an active software update subscription at no additional cost.

Where to buy

If you still do not have an Atola Insight Forensic and would like to place an order, this can be done directly via Atola Technology, or from a distributor near you:

http://atola.com/wheretobuy/

The extension modules can be acquired directly via Atola Technology.

We still have an upgrade program for owners of old Atola Insight v3.x. Please contact our Atola Technology sales to receive more specific information:

 

Tags:

How to resolve DiskSense / HASP connection issues

DiskSense hardware system includes an internal HASP USB dongle. It contains unique activation and subscription information.

Having more than one DiskSense system in your network may result in HASP-related conflicts. These conflicts usually manifest as “Too many connections” or “Cannot located DiskSense unit” errors. The issue is caused by behavior of the HASP discovery system which by default picks a random HASP dongle on the network. In other words, one Atola Insight Forensic instance may establish the connection with one DiskSense system, however it will “use” the HASP dongle of another (random) system available on the network.

How to resolve multiple HASP connection issues

We would like to share the solution with you. HASP discovery system offers a web administration tool where one can easily set up IP filter specifying HASP dongle search locations.

  1. Access the URL with your browser: http://localhost:1947
  2. Click ‘Configuration’ link in the left side menu
  3. Click ‘Access to Remote License Managers’ tab
  4. Untick ‘Broadcast Search for Remote Licenses’ checkbox
  5. Enter specific DiskSense IP you want to be connected to
  6. Click ‘Submit’

After you perform the actions, the final screen should look like like this:

Note: 192.168.0.200 is used as an example.

hasp-discovery

Tags: , , ,

Atola Insight Forensic 4.3 with Apple SSD support

We thank you all for supporting our product and proudly present Atola Insight Forensic 4.3 release. Record 170 fixes and improvements included in the new version. So hurry up to update your software!

Several major changes we want to focus your attention on are described below.

The full list of Atola Insight Forensic 4.3 changes can be found here: Atola Insight Forensic Changelog.

Apple PCIe SSD support

Insight 4.3 is the first version that is able to work with the newest PCIe SSDs from Apple MacBooks (2013 – current models). It can be made via new Atola adapter pluggable in the Extension port which is located on the DiskSense unit’s side with cooling fans:

Extension port for Apple PCIe SSD adapter

The new Insight version can perform SSD Trim, hash calculation, wiping, comparison, file recovery and of course imaging of the newest MacBook drives. By means of the new Atola extension adapter, Insight 4.3 can image such SSDs in a remarkably fast manner reaching 24 GB per minute speed.

Apple PCIe SSD

Hashes in File Recovery

All files of any target port have hashing enabled by default in File Recovery. Files hashes are calculated in the background for every file set found during reading device folders. Calculated hashes are automatically saved into a respective target case folder to avoid calculating twice the same file hash .

Insight > Preferences has now the File Recovery tab allowing to switch on/off Hash and other columns. It can separately be set up either for source port or target ports.

We have also added “Hash all files” button that may help in situation when it is necessary to calculate all hashes before performing file recovery.

Hashes

Advanced search options in File Recovery

Newly added file hashes can be specified in search conditions. Here’s the full list of search conditions added to Insight 4.3:

  • Date accessed
  • Date created
  • Date modified
  • File attributes (hidden)
  • First bytes (file signature)
  • Hash
  • Size

Each of these can be specified many times with different values and operation (more/less than, equals, between, etc.)

All new filters are grouped into a preset and can be exported to a file and imported from it. Thus, you can share search presets with your co-workers.

File Recovery search options

E01 image files

The new version supports imaging to one or more E01 files. So now Insight Forensic has three types of image files what might be beneficial in different situations:

  • E01 (EWF)
  • Growing
  • Preallocated

E01

Case port on the top panel

You can now search and open cases on a separate new Case port while source port is running some operation. It allows to work with your case history in a faster and more convenient fashion while multi-tasking.

Opened Case

 Specific support of new drive models

Recovery of unknown passwords is enhanced for such drive models as:

  • Hitachi: A9A3, CLA3, A7E6, A9E6 families
  • Toshiba DT
  • Samsung HD502IJ, HM160HI and similar models with certain firmware reading problems

Head-selection imaging and scanning is now possible for the following Toshiba drive families: MK, MQ, DT

Automatic Checkup head analysis become more robust after improvements made for specific WD, Hitachi and Toshiba drives.

 

All other major Insight Forensic 4.3 changes are listed here: Atola Insight Forensic Changelog.

How to upgrade

Insight Forensic 4.3 is available for download by all customers with an active software update subscription at no additional cost.

Where to buy

If you still do not have an Atola Insight Forensic and would like to place an order, this can be done directly via Atola Technology, or from a distributor near you:

http://atola.com/wheretobuy/

The extension adapter for Apple SSDs can be acquired directly via Atola Technology.

Pay attention we have an upgrade program for owners of old Atola Insight. Please contact our Atola Technology sales to receive more specific information:

 

P.S. Dear customers, your feedback is always welcomed, so please feel free to write comments below.