Atola Insight Forensic
File Recovery is the part of the Atola Insight Forensic system that provides file extraction capabilities for both good and damaged drives. It supports all versions of the most popular operating systems: Windows, Mac OS X and Linux.
Supported file systems:
Recovery of deleted files supported for:
Benefits of an all-in-one solution
While being a very powerful tool on its own, the File Recovery module in Atola Insight Forensic has even more power with the help of a tight integration with the imaging module – the process for disk duplication.
During the imaging process, Insight not only copies data from one disk to another, but also analyzes the data and saves information about copied sectors and errors which were found on the source device. This information is used in File Recovery to find and extract a file's data and to provide additional information regarding file status.
Start by selecting the media
Atola Insight Forensic allows the user to select any supported media item attached to the DiskSense unit or host computer for file recovery. The user can also select any image file stored on any attached media item. Searching for attached media and selecting an item for recovery is quick and easy.
Status for each file
When a disk is imaged using Atola Insight Forensic, the File Recovery is able to show status of each file in the file browser, such as what percentage of file was imaged without errors. With just a glance you can see which files are damaged and to what degree.
Atola Insight Forensic has the ability to create lists of files specifying the status of each file. After creation, the list may be presented to the examiner for a review, and the examiner will be able to tell whether all their important files are fully recovered or not.
It is now very easy to find out the exact part of a file that wasn't imaged correctly. With one click, you have access to the file's sector map. In this map, you will see a color-coded representation of all the parts of the file that were imaged correctly as well as the parts that were not imaged due to bad sectors, etc. It allows you to very quickly estimate the file's "health" and re-attempt imaging of the specific sectors of a file if needed.
This feature allows to import text files containing huge lists of file hashes. Those can be treated as white or black hashes. The idea behind these types is simple:
Example: Picture below shows Black and Unknown hash filters activated. Thus, more than 1300 White hash files from "/usr/bin" folder are filtered out. So you can notice there are two suspicious files in the end.
Powerful forensic file search
File Recovery possesses advanced search capabilities helping to quickly find files you need. The search file mask includes wildcards as well as regular expressions. Search results are filtered by various conditions/filters that can be easily combined:
After File Recovery is complete, a full report is automatically created listing files successfully recovered, files not successfully recovered, and files with skipped sectors. This report is automatically stored in the Atola Insight's case management system.
Frequently Asked Questions
Click questions to expand text