On Tuesday, June 16 Atola’s Yulia Samoteykina spoke at Interpol’s annual Digital Forensic Expert Group. After the presentation about our imagers’ multi-pass imaging system and other damaged media functionality, we received a few follow-up questions. In this blog we would like to reiterate the answers to these questions:
Can Atola imager acquire evidence from damaged SSDs?
As is true with any type of media, the degree of damage will inform how we can help with data recovery from a specific device. SSD failures fall into three major categories: logical errors, hardware issues, firmware failure.
Atola imagers may be able to image data from an SSD with logical errors or hardware issues (e.g. NAND flash wear-out) with the help of our multi-pass imaging system. A good predictor of success can be the Media Scan stage of the diagnostics process.
How do you resolve an issue of imaging a drive (Ext4), if “Failed to copy” message showed up while using another forensic imager?
If there are bad sectors in the area where the metadata of the file system is stored, some of the files or the whole of the partition may not be found by regular tools. But the files could have been imaged without the file system’s metadata and may be available for acquisition with the help of Insight’s File Recovery functionality.
Can Atola imagers retrieve data from water-damaged hard drives?
Depending on the kind of contact (it can range from sprinkles to complete submergence), the duration of such impact and even the composition of the water (if there is residue in the form of salts), the impact on the drive could vary substantially. And in some cases, it can be quite dramatic. Therefore Atola engineers recommend you bring such drives to a cleanroom for the initial damage assessment, repair, and cleaning.
Once you receive the repaired drive back from the cleanroom, run diagnostics with an Atola imager. It is very likely that there has been damage to the platters, and our multi-pass imaging system will acquire the image as usual.
Will Atola TaskForce support AFF4 file format?
Yes, Atola is planning to support AFF4 and other logical image file formats (also including L01 and NFI) in our upcoming releases.
Is segmented hashing accepted in the court of law as a proper way of verifying data?
Yes, segmented hashing has been a principle successfully used by forensic examiners. This principle is well reflected in academic works, it is also widely used in cryptography and secure data modification. In digital forensics, the principle has been adopted by a number of vendors who support AFF4 image files, including X-Ways, BlackBag Macquisition, Evimetry.
With the forensic examiner’s proper understanding of the concept and ability to demonstrate it to the court, segmented hashing is as good a verification method as any.
Join us at our weekly virtual booth session. We always have an engineer with us, and we will be happy to answer any questions you may have!
- Forensic RAID rebuild in Atola TaskForce 2020.7 - July 30, 2020
- Q&A during the Interpol Digital Forensics Expert Group 2020 - June 19, 2020
- Insight Forensic 4.16 released with E01 segmented images - May 5, 2020