A new software update for Atola Insight Forensic is ready for download!
Version 5.5 brings support for the iSCSI protocol and makes it possible to image drives that are soldered into a motherboard, working servers that couldn’t be turned off, or devices for which you have legal warrant to access but not seize.
Use iSCSI for remote image acquisition
Before, the remote imaging option in Insight Forensic was only available for specific models of MacBooks Pro and Air released in 2016-2017 by using a Thunderbolt extension module.
Now, thanks to iSCSI support in Insight Forensic, you can add up to 3 remote network drives simultaneously and image them in parallel.
This feature, available on both DiskSense and DiskSense 2 hardware units, could come in handy when you, for example, have to acquire data from an evidence drive that is soldered into a laptop or is connected to a PC or server that couldn’t be turned off or seized.
To add an iSCSI device for image acquisition in Insight Forensic, first you need to make it available on the host computer or server via iSCSI protocol. To learn how to properly set things up with iSCSI in Linux, check this article on the Red Hat Customer Portal.
Control the state of an NVMe drive
Insight Forensic version 5.5 now includes a new status bar for NVMe drives. You can use this feature to monitor the different properties of your drive, such as temperature and power status, in real-time.
Here’s the meaning of each register:
Link: This indicator is enabled when device presence is detected, and a link with its NVMe controller is initialized.
RDY: Ready. This bit is enabled when the NVMe controller is ready to accept commands.
CFS: Controller Fatal Status. This bit is enabled if the controller has an error condition and is unable to communicate with software via completion queue entries.
APS: Active Power State. This field indicates the current power state of the controller, or the power state into which the controller is transitioning. APS 0 is the most power-consuming state activated when the drive is reading or writing blocks. All possible power states of the drive are listed in its diagnostics report.
Temp: Current drive temperature. It turns orange if it exceeds the drive’s Warning temperature level and red if it exceeds the Critical temperature level.
Also, now you can track two more parameters of an NVMe drive in its Diagnostic report:
- A table with all possible power states of a drive provides details about max power consumption and latency of switching between power states.
- Warning and Critical temperature levels show when a drive starts overheating. These parameters are received from controller data.
Insight Forensic 5.5 Changelog
New Features
System-wide support for iSCSI drives.
CHAP discovery and login credentials are available for optional use.
Imaging:
- iSCSI. 3 parallel imaging sessions for both DiskSense 2 and DiskSense 1 units.
- Advanced statistics of read errors in the final report. Example: 900 errors (100 UNC, 200 ABRT, 700 Timeout).
- Ability to resume imaging to an E01 file on a network after losing network connection or unplugging PC device.
- Ability to resume imaging to an E01 file on a target drive in the event of an unexpected failure.
NVMe drives, for DiskSense 2 unit only:
- New Status bar showing live drive state, including its temperature.
- Diagnostics. Added table of power states, PCIe generation, and temperature levels.
- Home page. Added Critical and Warning temperature values.
Multi-launch menu. Support of quick launch of all operations for image files.
Automatic checkup:
- File system. Improved analysis of FAT32, ext4/3/2, HFS.
- File system. Bitlocker analysis now includes all FVE Metadata Blocks.
Better detection of vendor specific SMART attributes of different SSD models such as:
- Acer SSD RE100
- HP SSD S650
- HP Portable SSD P600
- TEAM T253240GB
- Transcend TS512GSSD230S
Disk Editor:
- Added ASCII text mode for byte signature search (the ‘Find’ button).
- New 64-bit field in Data inspector.
- Enhanced visual selection of values in Data inspector and HEX view.
- Current offset supports copy-paste hotkey.
Artifact Finder:
- Improved performance of Search when 50M+ artifacts are found.
Compare. Last selected parameters are stored now.
UI enhancements:
- Case report. Log height can be adjusted.
- Short-circuit detection for target SATA drives in the target selection dialog.
- Each validated text box has only a red border without a red background.
Bugfixes
Imaging:
- Imaging freeze after Windows enters Sleep mode.
- Possible imaging freeze after changing live settings for bad drives (especially, bad heads).
- Rare error with the message “Column ‘TargetSessionGuid’ is constrained to be unique”.
- By-head imaging completion could take several minutes instead of 10-20 seconds.
Automatic Checkup:
- Firmware. Unrecognized password protection of SanDisk Extreme Portable drives.
- File system. Bitlocker volume could not be detected when the partition type is unknown.
Artifact Finder: The results didn’t include IP addresses that are not delimited by spaces.
Failed to open E01 files created by UFS Explorer.
Unable to identify USB Seagate One Touch drives.
Incorrect 0B capacity of an NVMe drive connected via Orico RTL 9210 adapter.
UI would freeze for 2 minutes after a loss of network connection when an image file was opened in a network folder.
The bottom menu items in the sidebar didn’t fit when the system font size was 150% and the screen resolution wasn’t higher than 1920 x 1080.
The Sentinel Error 7 message was still possible, preventing connection to the DiskSense unit.
Download
To get access to all new features, download Atola Insight Forensic 5.5 from our website.
Where to buy
To order Atola DiskSense 2 hardware unit or extend your subscription, contact Atola Technology directly or find a distributor near you.
To get more information about Atola Insight Forensic or to discuss the details, please contact Atola Technology sales department:
- Call us: +1 888 540 2010, +1 416 833 3501 10AM-6PM ET
- Or email us
- Insight Forensic 5.6 – Now with Btrfs and LVM support - December 10, 2024
- TaskForce 2024.9 update – Templates for target files - September 26, 2024
- E01 vs AFF4: Which image format is faster? - July 9, 2024
Sergiy Pasyuta
Sergiy is an experienced technical writer with a passion for simplifying complex concepts in user manuals. With a keen eye for detail and a knack for clear communication, he crafts articles that guide users through our products’ functionalities.
