Atola Insight Forensic supports imaging into a file on an encrypted target drive, using VeraCrypt for data encryption.
After your source drive is identified by the system, take the following steps:

  1. Go to the Imaging category in the left-side menu on the home screen; 
  2. Click the Create New Session link to launch an imaging session;
  3. Tick your target device; 
  4. Click the link Create Image File on Target.
Atola Insight Forensic: Creating Image File on Target

5. In the pop-up window, select Create an encrypted VeraCrypt container (exFAT) option and click the Next button.

Atola Insight Forensic: Creating exFAT

6. To complete the creation of a VeraCrypt volume, enter the password.

Atola Insight Forensic: Creating VeraCrypt Volume

7. Enter YES and click Format to confirm formatting the drive to create the encrypted partition.

Atola Insight Forensic: Creating exFAT partition

Formatting will take a few seconds.

Atola Insight Forensic: exFAT partition creating

8. Name new image file, click the Add button and then click Select. 

Atola Insight Forensic: Selecting File

9. Specify the settings for this imaging session and click the Start Imaging button.

Atola Insight Forensic: Starting New Imaging Session

After you click the Start Imaging button, Insight will start imaging data into the file on your encrypted target.

Atola Insight Forensic: Imaging process

Upon completion of the imaging session, check the Imaging results screen. 

Atola Insight Forensic: Imaging Results

Data Extraction:

  1. To find the VeraCrypt volume and the imaged file, plug the target drive into your computer;
  2. Use VeraCrypt software to safely access encrypted data from your drive;
  3. Select the drive label (A, B, C, etc.) on which you want the volume to be mounted;
  4. Click Select device button;
  5. In the pop-up window select your encrypted volume;
  6. Click the Mount button. 

Now you can view the partition name, size and encryption algorithm.

Atola Insight Forensic: Partition

7. Next, use the password set prior to the imaging session to get access to the encrypted volume.

Atola Insight Forensic: Accessing the encrypted volume

Once you have entered the password, the volume will be mounted and you can access it from Windows Explorer and use the image for subsequent operations.

Atola Insight Forensic: Accessing the volume from Windows Explorer

 

Olga Milishenko

Olga Milishenko

Olga believes that marketing is about letting the target audience fall in love with your product. She takes pleasure in catching the coolest features of Atola imagers with her camera.

Leave a Reply

Your email address will not be published. Required fields are marked *