Locate Sectors in Atola Insight Forensic 5.1

We are excited to release one of the biggest software updates for Atola Insight Forensic!

The 5.1 version supports both DiskSense and DiskSense 2 units. On top of that, with 5.1, Atola Insight Forensic has become a 64-bit application and is no longer limited to ~4 GB of memory.

The major changes in the new Atola Insight are:

• app-wide XFS support
• performance and memory improvements
• a first-in-the-industry feature: Locate Sectors

We continue to push boundaries and innovate. Our team believes that a modern imaging hardware should provide more than images with hashes. Atola Insight Forensic has always been famous for damaged drive diagnostics and imaging. Later, sector-level artifact search during imaging sessions and segmented hashing added extra value to our customers. Now it’s time to look at your evidence drives and images in a new way!

Locate Sectors

Locate Sectors is a new operation that empowers to quickly figure out the answer to the question:

Which file does this sector belong to?

There are quite a few cases where it comes in handy.

1. Evidence drive has bad sectors

Evidence imaging ends up with 87 read errors. It’s necessary to find out which files were impacted by bad sectors. This may be the question asked by a judge in a court.

Locate Sectors provides you with an answer and generates a corresponding error report.

 

2. Artifact finder marked a sector containing valuable information

While Insight performs source drive imaging, there is an extremely fast Artifact Finder providing you with an output of actionable data during imaging. It is enabled by default and works at the sector level, analyzing bytes in the imaged sectors on-the-fly. The most useful results are emails, GPS coordinates, IP addresses, MAC addresses, Phone numbers, custom keywords and regular expressions.

So imagine you got a sector 8,624,030 with suspicious GPS coordinates. Instantly, you want to know the file containing the sector. Here is how you can locate the sector.

Locating the sectors ends up with the detailed result:

Changelog

New Features

Locate Sectors, a new operation that finds a file by a specific sector it contains

XFS support in Imaging, File Recovery, Automatic Checkup

Insight Forensic became a 64-bit application removing the 4 GB memory limit in use 

Imaging:

• Estimated time left algorithm improved to be more precise
• A better output of E01 metadata in imaging reports

Automatic checkup. NVMe drives support (DiskSense 2 unit only).

Work folder change moves all internal case folders and correspondingly updates MS SQL database.

Case management:

• Home page. New link Show all targets to open the list of all imaging targets for the source device in a single table.
• New Set case details after source identification option in Preferences.

Disk Editor:

• Ability to locate every sector (see Locate Sectors feature for more detail). 
• Data template enhancements. Backward link navigation with new arrow buttons + GPT parsing 

Tooltips for all SATA registers in the status bar

Bugfixes

Rare FAT32 parsing issue in File Recovery and Imaging

Memory leak noticeable after a long-lasting use of Atola Insight

Imaging: 

• It was impossible to launch imaging to an E01 file when a source device had a serial number longer than 50 characters
• Incorrect Imaging completed message in the log when “After 1500 consecutive errors – terminate imaging” rule was applied. The message now is Imaging terminated
• Unchecked “Fill unreadable sectors” option had no impact on pre-hash calculation
• Possible incorrect speed statistics during Macbook Air imaging into two targets
• Create new imaging session could hang the application up when the source device could not be identified

Automatic checkup. Invalid “The motor does not consume proper current on spin up. The motor may be stuck, or the circuit board is malfunctioning.” diagnosis for SSDs with non-working PCB.

Case management. Case number could not be assigned for devices, whose model name or serial contain slash ‘/’ character.

File recovery:

• Several issues when the process of recovering files could freeze
• FAT32. Non-deleted filter was not hiding deleted folders

DiskSense 2 unit only:

• SATA source 2 was not identifiable when an active imaging session was running to a USB target
• Target port duplicates could be opened for the same port
• SAS extension was not always waiting for SAS drive readiness when it was taking too long
• Current measurement subsystem could stop working when performing multiple Automatic checkups and opening Oscilloscope windows
• Automatic checkup for IDE was failing the first time after DiskSense 2 unit boot

Download

You can download the latest update here: Insight Forensic 5.1

Where to buy

If you still do not have an Atola Insight Forensic and would like to place an order, contact Atola Technology directly, or a distributor near you:

https://atola.com/wheretobuy/

Please contact Atola Technology sales department to receive more specific information:

• Call us: +1 888 540-2010, +1 416 833-3501 10am – 6pm ET
• Or email us

P.S. Dear customers, we appreciate your feedback and take it into consideration when updating our products. Please feel free to write your thoughts and ideas in the comments section below.