Hard drive duplication is the most important part of the data recovery or data acquisition process. Trying to extract files directly from the original HDD is dangerous because the hard drive can fail at any moment. This means the technician must transfer the data quickly and safely from the original HDD to a backup HDD and only then proceed with file extraction using the backup.
The Atola Insight is the industry's most efficient system for imaging hard drives quickly and safely. Its maximum imaging speed is 180 MB/s.
Please note that this is the measured speed that we have achieved on real hard drives (please see screenshot on the right) and not "theoretically achievable" speed that many other tools claim.
Table of contents:
Imaging damaged disk drivesHard drives with physical damage require a quite complex imaging approach. Specifically, the following techniques are used in Atola Insight in order to achieve the best results:
This technique allows to achieve real imaging speeds of up to 180 MB/sec on good areas of the drive, while approaching bad areas in the most gentle way possible, thus achieving an unbeatable overall speed of disk duplication.
The best part is that Atola Insight will handle block sizes automatically, thus providing the best possible results in the shortest amount of time. This allows Atola Insight to be faster on virtually any job than any other data recovery or acquisition tool available on the market.
Customize every step of the process
The Atola Insight is able to image entire hard drives, select partitions or specific sector ranges. The newly created image can be stored either on a destination hard drive or the host computer. A data wipe function is also available to quickly and easily write any pattern to the destination hard drive if necessary to prepare it for a new image.
All parameters can be adjusted in a very simple way to fine-tune the process and meet the needs of a specific case. The Atola Insight is able to image damaged or unstable hard drives in the field that cannot be imaged by regular forensic products. This means technicians can image more hard drives in the field without needing to take them back to their labs.
Multiple hashing methods are available and hashes are calculated on the fly. GList auto reallocation can be disabled to prevent the hard drive from contaminating evidence by remapping sectors.
Major Imaging Parameters
Visual representation of imaging status
The Atola Insight's real-time imaging status screen provides all vital information to the operator as well as full control over the process (please see screenshot on the right).
Visual feedback includes:
Based on the data being displayed throughout the imaging process, the operator has the option of making on-the-fly changes to the parameters. For example, the operator can not only adjust timeouts, but also add another imaging pass to the end of the function to revisit areas with multiple errors, or add a specific behavior on a certain condition (power cycle after X errors, etc).
The following actions can be performed during imaging:
This kind of flexibility is unmatched by any other data recovery or forensic tool.
When the imaging is complete, all status information is automatically sent to the Case Management and File Recovery modules.
Data-Only copy option
This option gives the user the ability to only copy occupied sectors from the source hard drive. This can greatly reduce the time spent on data transfer and relieve strain on the source hard drive.
Supported file systems: NTFS (all versions), Ext 2/3/4, HFS, HFS+, HFSX, ExFAT, FAT16, FAT32.
Image file creation
Copying the source disk into an image file is fast and easy using the Atola Insight. Just select a storage location on the host PC or media and specify the image file size (put all data in 1 image file or "chunk" the data into a series of smaller files).
Fully integrated with file recovery module
At the end of the duplication process, the Atola Insight creates a Bad Sector Map and stores it in the Case History. When the File Recovery module is started, it automatically refers to the Bad Sector Map, and marks all files hit by bad sectors.
A list of recovered files has already been recorded during imaging, and the data is ready for browsing, so there is zero time loss on this stage. This system is much more efficient than using one product for imaging and another for file recovery, because the operator would have to image the hard drive and then re-scan it with file recovery software when using two separate products.
Frequently Asked Questions
Click questions to expand text