We have just returned from Techno Security & Digital Forensics Conference, which took place on September 18-20 in San Antonio, Texas. Here are some of the questions asked at this event, which we would like to share with you, along with our answers to them. Should you have further queries, please don’t hesitate to write a comment below or send us a message here.
Question: Is there a reason why segmented hashing should be used to calculate hash of drives that are not damaged?
Answer: Yes, segmented hash allows you to verify evidence on the drive and its image even if either of them becomes damaged at some point in the future. With regular hashes you will get a hash mismatch upon verification and the entire image becomes useless. But with segmented hashing only a single hash value will become invalid while the rest of the image can still be validated.
Question: Is it possible to adjust imaging settings during imaging?
Answer: Yes, it is possible to do that by clicking Imaging settings link in the upper part of Insight’s window.
It is possible to adjust the following settings:
- post-hash target device(s)
- reverse direction on individual passes
- disable read look-ahead
- maximum number of consecutive power cycles
- actions on consecutive read errors
- compare source and target after imaging
- power down source device when finished
- read SMART information before the beginning and after the end of imaging
- head selection
- enable email status notification
However, certain options cannot be adjusted on the fly (e.g. number of passes and some of their preferences, hash method and type, filling errors with patterns etc.). If you need to make changes to these settings, pause the current session and click Add new session link located under the paused session, and adjust settings before clicking Start Imaging button.
Question: Can Insight achieve top imaging speeds when saving an image file to a location on a local network?
Answer: Insight’s 10Gbit Ethernet extension module allows imaging drives to a local network at top speeds as well as performing file recovery, compare, write from file.
However, a few minor adjustments need to be made:
- Update the 10GbE driver on PC workstation to the latest version
- Link 10GbE Ethernet extension module and 10GbE PC workstation LAN adapter with a Cat6 ethernet cable
- Open Windows Network and Sharing Center
- Click Change adapter settings link
- Locate 10GbE Ethernet card and open its Properties by clicking with the right mouse button
- Click Configure button
- Select Advanced tab
- Change Jumbo Packet value to 9014
Note that PC motherboard quality can have an impact on the resulting network performance and ensure that the PC drive is able to read/write at speeds above 300 MB/s.
Question: If an imaging session is paused, and then a new imaging session with the same source and target devices is created, will Insight image all sectors in range all over again?
Answer: No, Insight will only image the sectors that remained unimaged after the previous session.
e.g. if Insight has already imaged sectors 0 – 5,000,000 before imaging was paused, it will image sectors 5,000,001 onwards when imaging from the same source to the same target is started. However, if a different target device is connected, imaging will start from sector 0.
Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.
- Top digital forensic conferences in 2024 - January 1, 2024
- 2023. Year in Review - December 31, 2023
- Top digital forensics conferences in 2023 - January 1, 2023
Yulia Samoteykina
Director of Marketing Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.
