Atola Insight Forensic has a complex imaging functionality, which allows imaging even physically damaged hard drives, while avoiding further drive deterioration. Damaged drives require a complex imaging approach, which would balance thorough data extraction with forensics’ need in expediency and measured treatment of damaged media.
Most imagers have a linear imaging process, and whenever such imager encounters a bad sector on a drive, the process slows down drastically, which often causes the drive to freeze. To speed up imaging of damaged drives and maximize the amount of successfully retrieved data, Insight operates using a special imaging algorithm that provides deliberate timeout and block size control.
Using small block size pays off when you need to thoroughly retrieve maximum data from an unstable drive, but it also significantly slows down imaging process. What’s worse, such approach increases the possibility of causing further damage to the media. That’s why Insight’s multi-pass imaging engine uses large blocks with short timeouts on the first few passes, scheduling reads inside slow areas for later and then using the smallest block size on the last pass when fewer sectors are left to be read.
This technique helps achieve imaging speeds of 500 MB/sec in good areas of the drive, while approaching bad areas in the most gentle way possible and reaching unbeatable overall speed of disk duplication.
The best part is that Atola Insight Forensic will handle block sizes automatically, thus providing the best possible results in the shortest amount of time. This allows Atola Insight Forensic to be faster in virtually any job than any other data recovery or image acquisition tools commercially available.
Block sizes and timeouts are adjustable. However, the default settings of the passes are based on our decades-long experience in data recovery market to fit most problematic drives. Therefore, it is advisable to follow them, unless a particular drive requires specific settings.
Atola Insight Forensic: Starting new imaging session
On the first pass, Insight allows 1-second Timeout per block, and the Max read block size is set to 4096 sectors. The settings of the first pass allow smooth sequential imaging of all modern hard drives, whose media is sound. But when imaging damaged drives, these settings make Insight skip any areas that slow down reading and perform Jump on error by 1,000,000 sectors at a time. These settings ensure imaging data from the healthy areas of the drive at top speed, while forcing Insight to return to the problematic areas during the following passes, splitting such areas into smaller ones and allowing more time for reading the data within.
Atola Insight Forensic: Complex imaging approach
While Max read block size remains the same during the second and the third passes, the Jump on error is set to 20000 sectors and 4096 sectors respectively and slightly longer, 5-second Timeouts are allowed for attempted reading of the blocks.
Atola Insight Forensic: Imaging data
On the fourth pass, both Jump on error and Max read block size are yet again reduced, this time to 256 sectors.
On the fourth pass, both Jump on error and Max read block size are reduced to 256 sectors.
On the fifth pass Insight allocates 60-second Timeouts to read the Maximum block size of 256 with just 1-sector Jump on error. It is the last and the most scrupulous attempt to read the remaining bad areas of the drive.
Imaging pass 5 of 5: the most scrupulous attempt to read the remaining bad areas of the drive
After the final pass the Imaging Results report will appear to show the eventual number of errors on the drive and other detailed statistics.
Atola Insight Forensic: Imaging Results
When looking at the settings of the imaging passes, you will see the Reverse direction check boxes. With this function selected, Insight will approach skipped areas of the drive from the other side on any selected pass. This way Insight can get more data from a drive before entering a damaged zone, which needs to be concentrated on during the following passes.
Another option in the imaging pass settings, which is worth mentioning is Disable read look-ahead option. Most contemporary hard drives have read look-ahead functionality, which makes the drive read more blocks sequentially than requested by software. In good drives, this functionality helps the drive to operate faster by reading more data and caching them. But with bad drives, read look-ahead leads to bad areas being addressed more often, which slows down the process and may lead to a complete freeze of the drive. In such cases, disabling read look-ahead option is advisable.
Please note that when dealing with a damaged drive, we strongly recommend using Segmented hashing because this method supports multi-pass imaging and handling of bad sectors, and provides better resiliency against data corruption.
To read about the way Insight handles imaging of freezing damaged drives please follow this link.
Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.
- Top digital forensic conferences in 2024 - January 1, 2024
- 2023. Year in Review - December 31, 2023
- Top digital forensics conferences in 2023 - January 1, 2023
Yulia Samoteykina
Director of Marketing Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.
1 Comment
Bobby Rose · June 29, 2021 at 12:01 pm
My shop exclusively uses Atola products based on their effectiveness, ability to function unattended, and Atola’s constant R&D providing updates to match the evolving needs of the industry. Highly recommended!