Call us now: 888 540-2010,  416 833-3501   10am – 6pm ET

General Information
DiskSense Unit
Extensions
Battery
Supported Drives
Version Log

Ordering

Place an Order
Lifetime Warranty

Features

Disk Diagnostics
Disk Duplication
Selective Head Imaging
Password Removal
Segmented Hashing
Scripting
Case Management
Bad Sector Recovery
File Recovery
Firmware Recovery
Disk Utilities
Multi-Tasking

Information

Quickstart
Screencasts
FAQ

Frequently Asked Questions

Click questions to expand text

Expand all questions

Common Questions

  • What are the PC requirements for the Atola DiskSense unit?
    Atola Insight Forensic software requires a Windows PC. More details are available in the Atola Insight Forensic Manual.
  • How much variation is there in data transfer speed during imaging?
    The DiskSense Ethernet can reach speeds up to 500 MB/sec, but the speed may be as slow as 50 MB/sec (3 GB per minute) when working with older or slower HDD models.
  • How can I achieve the best duplication speed with the DiskSense unit?
    To have an acceptable throughput you would need to use a Gigabit Ethernet network card in your computer. If you plug DiskSense unit into a network switch, the switch has to be rated for Gigabit speeds (as well as all other intermediate switches between the unit and PC where Atola Insight Forensic software is installed). Gigabit Ethernet will give you the maximum speed of about 140 Mb/s when imaging via network.

    This does not affect the imaging speed when imaging onto a Target drive attached directly to the unit, in which case the imaging speed will be up to 500 MB/sec.

    There are few things to check to ensure high speed connection:

    1. Check that your Ethernet adapter supports Gigabit Ethernet. If it doesn't, then you would have to obtain a new Ethernet adapter that supports Gigabit Ethernet.
    2. If DiskSense is not directly attached to the PC but to a networking switch, then please make sure that the switch does support Gigabit Ethernet (as well as all other intermediate switches, if any). Ethernet adapter in the PC still must support Gigabit Ethernet.
    3. A misconfigured network switch or network adapter can cause a negative impact on the speed as well.
    4. Verify that all intermediate network cables between the unit and the PC are 5e category or higher (cat. 6).
    5. For maximum performance, DiskSense Ethernet unit should be connected directly to the Ethernet adapter on the PC without any intermediate network switches.
    There are other things that could affect transfer speeds like network adapter drivers, motherboard drivers, antivirus software and so on. However, complying with the rules above is enough for most cases.

    To verify the network speed you can do the following:

    1. Launch the Atola Insight Forensic software
    2. Connect a good and fast hard drive to the Source port of the DiskSense unit
    3. Navigate to Imaging, select Imaging to File option
    4. In the file selection dialog enter file name null. This special file name will force Insight to skip writing, thus target write speed will not affect the measurement. Data is still transferred through Ethernet.
    5. Begin imaging
    If everything is working properly, you should see speeds of 50 MB/s or higher.

Case Management

  • Is it possible to copy Insight Forensic database to another PC?
    Yes. Use "Cases > Export" function for that selecting all cases. It will create a single file which then can be imported via "Cases > Import" operation.
  • When a case is being continued, how can I tell which technician worked on the hard drive?
    In situations where different technicians are working on a single case, we recommend adding a note in the case history of who worked on each phase.
  • Can the user add notes to the case history after a case is closed?
    Yes. This can be done quickly and easily by opening the case history (Cases > Search/Open) and clicking "Add note".
  • Can 2 hard drives share 1 case number if they are related (example: 2 hard drives from an array)?
    Not at this time. Each case number can only be dedicated to a single hard drive. However, a note can be made in each case history explaining any connection to other cases. For example, “this hard drive is from the same array as case 8XB9906” or, “customer name: Jesse F.”

Diagnostics

  • How does the automatic diagnostic work and how accurate is it?
    The automatic diagnostic function applies a sophisticated system that analyzes electrical currents as they enter and leave the hard drive, examines the hard drive’s responsiveness to low level commands and incorporates firmware information (if it is accessible). Our studies had shown that this approach is accurate in pinpointing malfunctions in at least 95% cases.
  • I don’t have training on oscilloscope use. How will I know how to analyze electrical currents from the oscilloscope?
    Some data from the oscilloscope is very simple to understand (for example; when HDD power fails the lines go flat). Users can learn to understand more complex oscilloscope information by seeking advice from other data recovery technicians, seeking professional training, or simply through gaining experience in field.

    While current monitoring technology plays an important role in the Atola Insight’s operation, no specific skills are actually required since the current analysis is performed automatically by the tool.

  • Can RAID arrays be diagnosed as a single HDD?
    The Atola Insight will only diagnose the hard drive that is directly connected to the DiskSense unit. Hard drives from RAID Arrays must be diagnosed and recovered individually.

Disk Duplication

  • How does the Atola Insight Forensic compare to other imagers?
    We believe the Atola Insight Forensic is the strongest imaging/duplication system available on the market. It has every feature advertised by other products and much more. Atola products also have the smoothest, most user friendly interface of any imager on the market and we offer the strongest technical support to help users maximize their success with our product.
  • How often does the Insight actually image at the “max” speeds that are listed on this website?
    The “max” speeds listed on this website have been lab-tested for accuracy on modern hard drives. The actual speed of duplication (or any data transfer) depends on the speed of hard drives used in the process. During HDD-to-HDD duplication, the slower hard drive will determine the actual transfer speed because one hard drive can only receive data as fast as the other can send it, and visa versa.

  • Does Atola Insight Forensic utilize BIOS and/or Operating System functions in the DiskSense Ethernet unit to image data?
    DiskSense unit runs a Linux OS. We have built a highly-customized and fine-tuned kernel for this Linux OS, and our modifications block all BIOS and standard Linux I/O operations and allow the lowest level of control for SATA, USB and IDE ports. More information is available here: DiskSense Unit: under the hood
  • Why would I need to wipe/erase a hard drive before imaging data onto it?
    Some specific data recovery or forensic investigation scenarios require the target hard drive to be wiped/erased. This is usually done to make sure the software being used to recover files won’t extract old data that was previously on the destination HDD.

Device Utilities

  • What are the HPA and DCO functions used for?
    HPA and DCO are used mostly to limit capacity of an HDD. They reduce a hard drive’s capacity by making a certain portion of the drive invisible. For example, if you took a 500GB hard drive and set a DCO max LBA or HPA at 300GB, the hard drive would appear to computers and other devices as 300GB capacity. This process is sometimes referred to as “clipping” a hard drive. A DCO clip or HPA can be set or removed in seconds.

Firmware Recovery

  • Which hard drive models does the Atola Insight Forensic support for firmware recovery?
    The Atola Insight Forensic provides firmware recovery capability in two ways: by automatically repairing firmware and providing direct access to firmware files for manual repair. Different sets of hard drive models are supported for each of these approaches due to differences in firmware design by the hard drive manufacturers. For a complete and up to date list of supported hard drive models for firmware recovery, see the supported drives page.
  • How commonly do modern hard dives experience firmware corruption?
    Less than 10% of data recovery cases with modern hard drives involve firmware corruption. Occasionally, a manufacturer will release a hard drive with flawed firmware and data recovery labs will see a spike in firmware recovery jobs for a period of time.
  • What is the difference between firmware files stored in on the HDD platter and ROM/EEPROM/NVRAM?
    This depends on the HDD manufacturer and hard drive model. Each hard drive has its own preferences for where firmware data is stored.

Password Removal

  • How do hard drives become locked with ATA passwords?
    ATA passwords can be set through the computer’s BIOS or using special products like the Atola Insight. Freeware tools are available as well.
  • Does this function remove BIOS passwords?
    No. BIOS passwords are a different form of security that does not have to do directly with hard drive programming or the ATA standard (although, depending on the specific computer, an ATA password might be set by the BIOS when defining a BIOS password).
  • What hard drives are supported?
    Automatic password removal works for most hard drives available on the market. For more specific information, please refer to the Supported Drives List.

File Recovery

  • Does the speed of the DiskSense unit affect the speed of file recovery?
    The speed of the DiskSense unit affects the speed of scanning the entire hard drive as well as the speed of file restoration. Please note that the hard drive does not need to be scanned by the File Recovery module if it has already been duplicated/imaged using the Atola Insight Forensic because the Disk Duplication module automatically creates all data structures for the File Recovery module to reference.