Atola Insight Forensic
This manual is divided into the pages:
Please make sure that you have the following items in the package:
Hardware and OS requirements
Minimum hardware specs:
Recommended hardware specs for optimal performance:
Installing and updating the software
Please download and install the latest version of the software from the following link: Atola Insight Forensic Downloads. Update packages can be downloaded from the same page.
Atola Insight Forensic workflow
Atola Insight Forensic covers all phases of the data acquisition process:
1. Media diagnosis
Whenever you start working on a hard drive, the very first thing we recommend to do is to find out if the drive is damaged in any way, and if so, what is the extent of the damage.
The tool comes with fully automated hard drive diagnosis module. It diagnoses all hard drive components: printed circuit board (PCB), spindle motor, head stack, firmware, and file systems. Diagnostics will work properly even if the drive has burnt parts or damaged head stack – the routine makes use of the current monitor that is embedded into DiskSense unit.
After diagnostics finishes, the tool will prepare a report and let you know the exact issue with the drive; it will also suggest the next step to be able to retrieve the data.
2. Media recovery
Automatic ATA password recovery and removal
Atola Insight Forensic can recover and/or remove unknown HDD passwords (also known as ATA-passwords). For most hard drives the unlocking process is fully automated. Some hard drives (for example, latest 2.5-inch Hitachi hard drives) require a degree of manual interference. Operator can choose whether to display the password or just remove it and unlock the drive. Both security levels (High or Maximum) are supported.
List of hard drives currently supported by automatic password recovery routine can be obtained at http://atola.com/products/insight/supported-drives.html
Manual firmware recovery
If there is firmware damage that cannot be fixed automatically, you will have to proceed with manual firmware recovery procedure. Generally speaking, firmware recovery process includes of the following steps:
Backup is a very important part of the process. Make sure you have full firmware backup before you make any change to the firmware area.
Basic diagnostics of the firmware area is done during Automatic Diagnostics process (see Automatic Diagnostics). More in-depth diagnostics is done during firmware backup process, after which any firmware damage that may exist will become obvious, as damaged modules will have either "Read Failure" or "Bad Checksum" mark. Some of these damaged modules can be recovered by right-clicking them and selecting Recover (module will be re-generated and written to the drive). In some rare cases, when Atola Insight Forensic cannot regenerate the module, you would have to copy it from a donor drive (you would need to locate a similar hard drive, save that module from thata drive into a file, and then copy that file into the bad drive's firmware, replacing the damaged module).
Please note: if after the full firmware backup you find that there are many unreadable firmware modules (more than 10% of total number of modules), it might be a good indication that the head stack is malfunctioning. The best thing to do in this case is to reconfirm that the hard drive does not have a head damage before proceeding with firmware recovery attempt. Attempting firmware recovery on a hard drive with internal damage may result in an unrecoverable damage.
3. Image creation
Before you proceed with any file recovery attempt, it is very important that you have a sector-by-sector copy of the drive. This is done with the Imaging module available in the software.
Please see the following link for more information on imaging: http://atola.com/products/insight/disk-duplication.html
4. File recovery
After you made a copy of the original hard drive, you can start recovering files. File Recovery engine is able to show status of each file in the file browser, such as what percentage of file was imaged without errors. There's also an ability to create lists of files specifying the status of each file. After creation, the list may be presented for a review.
Supported file systems:
Learn more about File Recovery: http://atola/products/insight/file-recovery.html
This feature of Atola Insight Forensic helps keeping track everything you do with a particular hard drive. It also allows organizing firmware files that are being downloaded from hard drives (for example: firmware modules, NVRAM, etc).
You do not need to enable Case Management or take any additional actions for it to start functioning; it is fully embedded into Atola Insight Forensic and is working all the time.
Learn more about Case Management: http://atola.com/products/insight/case-management.html
Troubleshooting and frequently asked questions: http://atola.com/products/insight/faq
Download links and all other documents: http://atola.com/products/insight/customers