Call us now: 888 540-2010,  416 833-3501   10am – 6pm ET

General Information
DiskSense Unit
Extensions
Battery
Supported Drives
Version Log

Ordering

Place an Order
Lifetime Warranty

Features

Disk Diagnostics
Disk Duplication
Selective Head Imaging
Password Removal
Segmented Hashing
Scripting
Case Management
Bad Sector Recovery
File Recovery
Firmware Recovery
Disk Utilities
Multi-Tasking

Information

Quickstart
Screencasts
FAQ

File Recovery

File recovery

File Recovery is the part of the Atola Insight Forensic system that provides file extraction capabilities for both good and damaged drives. It supports all versions of the most popular operating systems: Windows, Mac OS X and Linux.

Supported file systems:
NTFS (all versions), Ext 2/3/4, HFS, HFS+, HFSX, ExFAT, FAT16, FAT32

Recovery of deleted files supported for:
NTFS (all versions), FAT16, FAT32, HFS, HFS+, HFSX

[skip to FAQ]

Benefits of an all-in-one solution

While being a very powerful tool on its own, the File Recovery module in Atola Insight Forensic has even more power with the help of a tight integration with the imaging module – the process for disk duplication.

During the imaging process, Insight not only copies data from one disk to another, but also analyzes the data and saves information about copied sectors and errors which were found on the source device. This information is used in File Recovery to find and extract a file's data and to provide additional information regarding file status.

Start by selecting the media

Atola Insight Forensic allows the user to select any supported media item attached to the DiskSense unit or host computer for file recovery. The user can also select any image file stored on any attached media item. Searching for attached media and selecting an item for recovery is quick and easy.

Status for each file

When a disk is imaged using Atola Insight Forensic, the File Recovery is able to show status of each file in the file browser, such as what percentage of file was imaged without errors. With just a glance you can see which files are damaged and to what degree.

File lists

Atola Insight Forensic has the ability to create lists of files specifying the status of each file. After creation, the list may be presented to the examiner for a review, and the examiner will be able to tell whether all their important files are fully recovered or not.

File map

It is now very easy to find out the exact part of a file that wasn't imaged correctly. With one click, you have access to the file's sector map. In this map, you will see a color-coded representation of all the parts of the file that were imaged correctly as well as the parts that were not imaged due to bad sectors, etc. It allows you to very quickly estimate the file's "health" and re-attempt imaging of the specific sectors of a file if needed.

Hash lists

This feature allows to import text files containing huge lists of file hashes. Those can be treated as white or black hashes. The idea behind these types is simple:

  • White hash term stands for a known good file created by known software.
  • Black hash means some known bad file. It could be a malware, hacking script, hidden illicit data file.
Having hash lists imported to Atola Insight DB, File Recovery analyzes every calculated file hash against the database. If file hash belongs to either white or black hash list, special marks are shown on the left of file hash values.

Example: Picture below shows Black and Unknown hash filters activated. Thus, more than 1300 White hash files from "/usr/bin" folder are filtered out. So you can notice there are two suspicious files in the end.

Powerful forensic file search

File Recovery possesses advanced search capabilities helping to quickly find files you need. The search file mask includes wildcards as well as regular expressions. Search results are filtered by various conditions/filters that can be easily combined:

  • Date accessed
  • Date created
  • Date modified
  • File attributes (hidden)
  • First bytes (file signature)
  • File set (files selected
  • Hash
  • Hash list
  • Size
Each of these can be specified many times with different values and operation (more/less than, equals, between, etc.)

Effective reporting

After File Recovery is complete, a full report is automatically created listing files successfully recovered, files not successfully recovered, and files with skipped sectors. This report is automatically stored in the Atola Insight's case management system.


Frequently Asked Questions

Click questions to expand text

  1. Does the speed of the DiskSense unit affect the speed of file recovery?
    The speed of the DiskSense unit affects the speed of scanning the entire hard drive as well as the speed of file restoration. Please note that the hard drive does not need to be scanned by the File Recovery module if it has already been duplicated/imaged using the Atola Insight Forensic because the Disk Duplication module automatically creates all data structures for the File Recovery module to reference.