Atola Blog

Watch this guide to learn how to optimize Insight’s imaging settings when working with a source drive with damaged or degraded heads.

Atola Insight Forensic 4.8 is released! In this version of Atola Insight Forensic software, we included a range of improvements to our core features. The full list of Atola Insight Forensic 4.8 changes can be found here: Atola Insight Forensic Changelog. Password recovery support on new drive models Password recovery now works on new Hitachi hard drives including Hitachi HCxxxxxxxA7A3xx, HTxxxxxxxA9E3xx, HTxxxxxxxA9E6xx. The latter is used in Sony PlayStation PS4 Pro gaming consoles, which was launched worldwide in November 2016. Source: ifixit.com Consolidation of segmented hashes For imaging sessions that include calculation of segmented hashes, we created a feature enabling you to consolidate the hashes calculated during each separate imaging session. To perform Read more…

Hard drives with physical damage require a complex imaging approach. This guide will explain how to retrieve data with the minimal risk of data loss on a drive with a damaged head stack. If an Automatic Checkup report indicates that there is a problem with the heads, look at the status of each head. If the status of a head or multiple heads is Degraded or Damaged, the drive will not be able to read all the data. What’s worse, even more sectors may soon become unavailable due to incorrect functioning of the drive’s hardware. We recommend that you start by imaging the heads, whose status is OK, as soon Read more…

When you image data from a drive involved in an investigation case, and the target drive will be holding a 1:1 clone of evidence data, in many cases it is critical that the target drive’s capacity is identical to that of the source drive. Should there be a difference in size between the source and the target devices, their hashes will be different too. However, if your SATA target drive has a larger capacity, you can limit its size to that of the source drive using Host Protected Area (HPA). It will make the sectors beyond this limit inaccessible to the hashing tools as well as the end user. To Read more…

Atola Insight Forensic 4.7 is released! This release comes with the new hashing concept which protects you from damaged target images and works in parallel with the multi-pass imaging engine. The full list of Atola Insight Forensic 4.7 changes can be found here: Atola Insight Forensic Changelog. How is segmented hashing different from regular hashing? With regular hashing, you get a single hash for the entire image. With segmented hashing, you end up with many hashes of corresponding LBA ranges (chunks) of the image. The sum of these LBA ranges represents the entire image, just not necessarily in sequential order. By validating all hashes in a set, you can still Read more…