Call us now: 888 540-2010,  416 833-3501   10am – 6pm ET

General Information
DiskSense Unit
Extensions
Battery
Supported Drives
Version Log

Ordering

Place an Order
Lifetime Warranty

Features

Disk Diagnostics
Disk Duplication
Selective Head Imaging
Password Removal
Segmented Hashing
Scripting
Case Management
Bad Sector Recovery
File Recovery
Firmware Recovery
Disk Utilities
Multi-Tasking

Information

Quickstart
Screencasts
FAQ

Disk Duplication

Disk-to-disk duplication

Hard drive duplication is the most important part of the data acquisition process. Trying to extract files directly from a potentially failing media is dangerous because the media can stop working at any moment. This means the operator must transfer the data quickly and safely from the original HDD to a backup HDD and only then proceed with further evidence analysis using the backup copy.

The Atola Insight Forensic is the industry's most efficient system for imaging hard drives, SSDs and USB mass storage media quickly and safely. The system's maximum imaging speed is 500 MB/s.

Please note that this is this number represents the real measured speed that we have achieved on real hard drives (please see screenshot on the right) and not "theoretically achievable" speed that many other tools claim.

Table of contents:

Imaging damaged disk drives

Hard drives with physical damage require a quite complex imaging approach. Specifically, the following techniques are used in Atola Insight in order to achieve the best results:

Imaging damaged drives
  • Multi-pass imaging with different timeouts for each pass
  • Reducing read block size to a very small value
  • Utilizing PHY reset and interface reset feature
  • Imaging data from good heads only
  • Bad sector recovery (How it works)
  • Programmable behavior and even more fine-tuning for the toughest cases

A few words on block size control. While it is important to use small block sizes in order to get as much data as possible, using small blocks significantly slows down the imaging process. However, with Atola Insight's industry leading multi-pass imaging engine, it is possible to use large blocks with short timeouts on the first few passes, and then use smallest block sizes on the last pass when only few sectors left to be transferred.

This technique allows to achieve real imaging speeds of up to 500 MB/sec on good areas of the drive, while approaching bad areas in the most gentle way possible, thus achieving an unbeatable overall speed of disk duplication.

The best part is that Atola Insight will handle block sizes automatically, thus providing the best possible results in the shortest amount of time. This allows Atola Insight to be faster on virtually any job than any other data recovery or image acquisition tools commercially available.

Multi-target imaging

Imaging to multiple targets

Atola Insight Forensic images source media onto 1, 2 or 3 targets simultaneously. The following target types are supported:

  • SATA-I/II/III hard drive or SSD attached to the DiskSense unit
  • USB-1.0/2.0/3.0 (SuperSpeed) hard drive or flash media attached to the DiskSense unit
  • Any device attached to the PC where the software is running
  • Image file located anywhere on a local PC
  • Anywhere on the network

Data-only disk imaging

HEX viewer

The real time data viewer shows the raw data that is being extracted from the source drive during imaging. There are two modes available:

- Automatic with refresh interval slider

- Manual by means of Read sector button

Automated sector analysis checks each sector for file system structures (NTFS File Record, boot sectors, etc.)


File signature analysis during imaging

File signatures

Atola Insight performs file signature analysis during imaging. It shows live stats of all found signatures while the data is being transferred with no negative effect on imaging performance. Moreover, you can easily check raw sector data for any found file using the HEX Viewer without even pausing the imaging process.

Customize every step of the process

The Atola Insight is able to image entire hard drives, select partitions or specific sector ranges. The newly created image can be stored either on a destination hard drive or the host computer. A data wipe function is also available to quickly and easily write any pattern to the destination hard drive if necessary to prepare it for a new image.

Disk duplication sessions

All parameters can be adjusted in a very simple way to fine-tune the process and meet the needs of a specific case. The Atola Insight is able to image damaged or unstable hard drives in the field that cannot be imaged by regular forensic products. This means forensic experts can image more storage devices in the field without needing to take them back to lab.

Multiple hashing methods are available and hashes are calculated on the fly.

Major Imaging Parameters

Disk duplication settings
  • Linear and segmented hash calculation (pre-hash, during imaging, post-hash): MD5, SHA1, SHA224, SHA256, SHA384, SHA512
  • Compare media after imaging
  • Specify read/write heads to transfer data from
  • HEX pattern to fill skipped sectors with (00 by default)
  • Read timeout setting
  • Number of sectors to skip after a failed read attempt
  • Number of passes
  • Apply Read-Long command on last pass (see Bad Sector Recovery)
  • Reduce HDD operating speed to PIO mode
  • Imaging direction (linear or reverse)
  • Define image file size (chunk size)
  • Abort after X amount of automatic HDD power cycles

Visual representation of imaging status

The Atola Insight's real-time imaging status screen provides all vital information to the operator as well as allows full control over the process.

Visual feedback includes:

  • Overall map of the hard drive's surface showing good and bad areas
  • Statistics (speed, good/bad sectors stats, ETA)
  • By-head read speed graph (allows for early detection of a failing head)
  • HEX Viewer with automated sector analysis
  • Log screen

Based on the data being displayed throughout the imaging process, the operator has the option of making on-the-fly changes to the parameters. For example, the operator can add a specific behavior on a certain condition (power cycle after X errors, etc), or modify timeout settings.

The following actions can be performed during imaging:

  • Stop the process (can be seamlessly resumed later at any time)
  • Create new imaging session to the same targets with completely different settings. It will share imaging map of the previous sessions, so already imaged sectors will not be re-imaged.
  • Restart imaging from any sector right away by pointing and clicking the overall map bar
  • Change imaging settings and apply them immediately without even pausing the process
    Imaging report

When imaging completes, all status information is automatically sent to the Case Management and File Recovery modules.

Imaging report contains all necessary information including SMART table of source drive before and after imaging process.

Image file creation

Copying the source disk into an image file is fast and easy using the Atola Insight. Just select a storage location on the host PC and specify the image file size (put all data in a single image file or "chop" the data into a series of smaller chunks).

Data-only disk imaging

Data-Only copy option

This option gives the user the ability to only copy occupied sectors from the source hard drive. This can greatly reduce the time spent on data transfer and relieve strain on the source hard drive, as empty areas of the source hard drive will not be imaged.

Supported file systems: NTFS (all versions), Ext 2/3/4, HFS, HFS+, HFSX, ExFAT, FAT16, FAT32.

Metadata-Only copy option

This imaging mode allows copying of absolute minimum amount of data for file browsing to work, this allows for imaging of specific files.

Fully integrated with file recovery module

At the end of the duplication process, the Atola Insight creates a Bad Sector Map and stores it in the Case History. When the File Recovery module is started, it automatically refers to the Bad Sector Map, and marks all files hit by bad sectors.

A list of recovered files has already been recorded during imaging, and the data is ready for browsing, so there is no time loss on this stage. This system is much more efficient than using one product for imaging and another for file recovery.

Frequently Asked Questions

Click questions to expand text

  1. How does the Atola Insight Forensic compare to other imagers?
    We believe the Atola Insight Forensic is the strongest imaging/duplication system available on the market. It has every feature advertised by other products and much more. Atola products also have the smoothest, most user friendly interface of any imager on the market and we offer the strongest technical support to help users maximize their success with our product.
  2. How often does the Insight actually image at the “max” speeds that are listed on this website?
    The “max” speeds listed on this website have been lab-tested for accuracy on modern hard drives. The actual speed of duplication (or any data transfer) depends on the speed of hard drives used in the process. During HDD-to-HDD duplication, the slower hard drive will determine the actual transfer speed because one hard drive can only receive data as fast as the other can send it, and visa versa.

  3. Does Atola Insight Forensic utilize BIOS and/or Operating System functions in the DiskSense Ethernet unit to image data?
    DiskSense unit runs a Linux OS. We have built a highly-customized and fine-tuned kernel for this Linux OS, and our modifications block all BIOS and standard Linux I/O operations and allow the lowest level of control for SATA, USB and IDE ports. More information is available here: DiskSense Unit: under the hood
  4. Why would I need to wipe/erase a hard drive before imaging data onto it?
    Some specific data recovery or forensic investigation scenarios require the target hard drive to be wiped/erased. This is usually done to make sure the software being used to recover files won’t extract old data that was previously on the destination HDD.