Atola Technology

Connecting MacBook using Thunderbolt extension module

Last week we released Atola Insight Forensic 4.9, which includes Thunderbolt extension module. This extension provides Insight users with the capability to image, calculate hash and perform other forensically sound operations on all generations of MacBooks.

This guide will explain how to connect a MacBook to Insight using Thunderbolt extension.

Extension and cables

Thunderbolt extension enables Insight to operate on all MacBooks with FireWire, Thunderbolt 2 and Thunderbolt 3 interfaces. There is no need to remove the SSD, Thunderbolt extension allows connecting the whole Apple laptop to Insight.

The extension module comes with:

  • Thunderbolt 3 to Thunderbolt 2 adapter (by Apple)
  • Thunderbolt 2 to FireWire adapter (by Apple)
  • FireWire cable

Connecting MacBook to DiskSense unit

1. Connect MacBook to DiskSense unit with the help of Thunderbolt extension and the FireWire cable (NB Both MacBook and DiskSense have to be turned off). Use the adapters to connect to the MacBooks with Thunderbolt 2 or Thunderbolt 3 interface.

2. Start DiskSense unit and launch Atola Insight Forensic on your computer.

3. Boot the MacBook in Target Disk Mode. To do that, start it up while holding down the T key. You should see a Firewire or Thunderbolt icon displayed on screen signifying that Target Disk Mode is detected and working.

4. Select Identify device option in the pop-up window.

5. In Source – Select MacBook Case window click Add new case button.

6. If this is the first time this MacBook is identified by Insight, you need to enter the Serial number of the MacBook in the pop-up window and click OK. The device has been identified. (NB MacBook’s serial number can be found on the bottom case).

 

Now you can perform these operations with the connected MacBook:

  • imaging
  • hash calculation
  • hash verification
  • comparing
  • media scan
  • file recovery

When a MacBook is connected to Insight for a subsequent session, it is possible to simply select the appropriate case from the table.

 

Atola Insight Forensic 4.9 – Thunderbolt extension

We are delighted to announce the release of Atola Insight Forensic 4.9!

With this release we introduce our new Thunderbolt extension module, which will enable forensically sound imaging and other operations on all generations of MacBooks.

The full list of Atola Insight Forensic 4.9 changes can be found here: Atola Insight Forensic Changelog.

Supported interfaces and functionality

Thunderbolt extension enables Insight to work on all MacBooks with the following interfaces:

  • FireWire
  • Thunderbolt 2
  • Thunderbolt 3

With the help of Thunderbolt extension module you can perform such operations:

  • imaging
  • hash calculation
  • hash verification
  • comparing
  • media scan
  • file recovery

2016 and 2017 generations of MacBooks have non-extractable SSD drives, so the only way to handle such drives is by booting the MacBook in Target mode. In fact, with Insight’s Thunderbolt extension you can operate on all Macbooks the same way, hard drive extraction is no longer necessary.

If you want to learn more about other 4.9 changes, visit this page: Atola Insight Forensic Changelog.

Where to buy

If you still do not have an Atola Insight Forensic and would like to place an order, this can be done directly via Atola Technology, or from a distributor near you:

http://atola.com/wheretobuy/

Please contact our Atola Technology sales to receive more specific information:

P.S. Dear customers, we appreciate your feedback and will take it into account when making changes to the product. Therefore, please feel free to write your thoughts or ideas as comments below.

Comparing hashes of source and target to find modified data

So you have a Source evidence drive and its image on a different device, and you have a record that their hash values were identical in the past.

If you get a different hash value when you calculate the hash of the target now, it could be due to hardware failure, or because the device containing your image was used by a third party.

To understand how substantial these changes are, you will want to locate the sectors that have been modified.

  1. In the Disk Utilities category click Compare subcategory.
  2. Make sure that the whole range of sectors of the drive and radio button next to Device on DiskSense Target Port option is selected
  3. Click Compare button.

Atola Insight Forensic’s high-performance compare function will compare the source and the target and will help you identify and locate the modified sectors:

Case Management: Print reports from a case

Insight’s Case Management system includes flexible printing functionality. To print a report click the Print link in the case’s Home page.

In the Print Case History window you get all the reports listed, sortable by date or by reported operation. It is possible to tick just some of the reports or select all reports in the case by ticking the check box in the header of the list. Below there are all pictures attached to the case, which you can also select to be printed.

At the top of the Print Case History window there are four check boxes with report listing and printing settings (click on the Case Management arrow to view all check boxes):

  • Insert page break after every report on print
  • Also show miscellaneous reports hides/displays all reports of seemingly minor importance, yet essential to some forensic specialists in accordance with their internal procedures
  • Also print CSV logs allows the printed version of the reports to include operation logs saved in CSV format
  • Also print segmented hashes also enables segmented hash saved in CSV files to be included in the printed version of the reports

It is possible to print or save the selected reports and pictures in a PDF, HTML or RTF file by clicking Save to file… or Print buttons.

If you have ticked the two later options, this is how the log and the segmented hashes will be displayed in the report:

How we test our devices

Today we are offering you a sneak peek into Atola Technology office to show you our device storage system.

As you know, Atola Insight Forensic and Atola Recycler both support the vast majority of 1.8-inch, 2.5-inch, 3.5-inch IDE, SATA and USB hard drives, USB Flash media as well as SD, Compactflash, and Memory Stick cards. Over the years, we have accumulated hundreds of devices to develop and test our systems on them. Some of the drives date back to 2003, when the company was founded, others were purchased or donated more recently.

Many are damaged, yet they are precious to us: we actually bought most of them in this condition to make sure our acquisition systems are equal to the challenge of imaging such devices.

Each device has a unique history with us, so from the early days, we have had a database listing the drives and documenting their specifications, origin, condition and contents. Airtable allows adding various details including pictures of actual devices to help us quickly find the most appropriate drive for our purposes.

But the fact that the drives were stored in boxes sorted by a few rough criteria made finding devices a challenging task. At one point we realized we needed to have an efficient storage system in place, which would help us store the drives correctly and locate them efficiently. And no generic solution would suit us. So we hired a company to design and produce it for us. That is how this beauty came into existence:

Each drive has a number, is stored in a static-shielding bag tagged with colored stickers to help immediately identify the condition of a drive if you need to grab an appropriate drive quickly without checking the database. Our team members each have a set of tokens with their names that must be left in place of the drives when they are removed from their cells. All for easy tracking of the drives and their whereabouts.