Atola Insight Forensic 4.4 is ready for download now!

The newest version got 3 new extension modules supported, 130+ improvements and bug fixes. In particular, we have been working really hard on the major new features addressed below.

Full Atola Insight Forensic 4.4 change log is available here: Changelog.

SAS extension module

SAS extension module was designed to diagnose SAS drives and acquire images from them. It is really easy in use. As any other extension module, it should be plugged in the Extension port located on the DiskSense unit. Then you connect a SAS drive to it and simply start working.

Atola Insight Forensic 4.4 supports damaged SAS drives, senses currents during Automatic Checkup, provides short circuit and overvoltage protection as well as write protection.

Forensic SAS extension module

Forensic SAS drive extension module

 

10 GBit Ethernet extension module

The 10GBit Ethernet module is primarily targeted to accelerate data transfer speed between PC and DiskSense system. It speeds up imaging source drive to an image file from 100 MB/s to 300-400 MB/s. File recovery from SATA/USB drives receives the same level of acceleration.

The extension module works via 10G Cat6 copper cable with RJ45 (8P8C) interface for connection.

There are some tips in the manual helping to get optimum performance. To open the manual, launch Atola Insight Forensic 4.4 and press F1 .

Forensic 10 GB extension module for Atola Insight

Forensic 10GB extension module

 

 M.2 PCIe/SATA extension module

This extension module allows to work with both PCIe and SATA drives with M.2 connector. It is another type of source drive you can select in Atola Insight. The extension supports damaged drives, write protection and lots of Atola Insight Forensic operations.

M2 PCIe Sata- SSD extension

 

M2 PCI SATA SSD extension moduleYou can also find more information about this and other Atola Insight extension modules.

Revamped E01 image file support

We totally revamped E01 (Encase) image file support in order to make it faster and support Pause/Resume feature in Imaging. This also helped to increase compatibility of E01 files produced via Atola Insight with some third-party forensic tools which are not tolerant to E01 metadata deviations.

Imaging Pause/Resume support for E01 image files

White/Black hash lists

New Atola Insight version allows to import text files containing huge lists of file hashes. Those can be treated as white or black hashes. The idea behind these types is simple:

  • White hash term stands for a known good file created by known software.
  • Black hash means some known bad file. It could be a malware, hacking script, hidden illicit data file.

Having hash lists imported to Atola Insight DB,  File Recovery analyzes every calculated file hash against the database. If file hash belongs to either white or black hash list, special marks are shown on the left of file hash values:

  • Files having white hashes detected are marked with ticks.
  • Files having black hashes are marked with warning triangles.

On top of that, White/Black hash list filtering is supported throughout whole File Recovery. It is available as ‘Hash list’ condition in Search window, so one could quickly find all files with unknown hashes (those that are not white or black) and begin working on them.

File browsing filters have also received three new options: White, Black, Unknown. Here is the example below. You can see Linux partition with /usr/bin folder opened that normally contains more than 1300 files.

Case 1. No filters applied

All files are shown. The ticked files are good ones since they have white hashes (marked with ticks).

All files are shown without filtering

Case 2. Black and Unknown hash list filters applied

All good files having White hash are filtered out. Thus, we just see two files which are valuable for further analysis. Hash of malicious.file was found in the black hash list. shady.me is not marked which means it could contain some interesting data inside.

File Recovery black and unknown hashes interested

All other 4.4 changes are listed here: Atola Insight Forensic Changelog.

How to upgrade

Atola Insight Forensic 4.4 is available for download to all customers with an active software update subscription at no additional cost.

Where to buy

If you still do not have an Atola Insight Forensic and would like to place an order, this can be done directly via Atola Technology, or from a distributor near you:

https://atola.com/wheretobuy/

The extension modules can be acquired directly via Atola Technology.

We still have an upgrade program for owners of old Atola Insight v3.x. Please contact our Atola Technology sales to receive more specific information:

 

Vitaliy Mokosiy

Vitaliy Mokosiy

Atola CTO He believes in saving time & energy of people doing mission-critical work. Therefore, all his efforts are focused on leading R&D of innovative Atola products. Gamification enthusiast. Agile development proponent.

Leave a Reply

Your email address will not be published. Required fields are marked *