Atola Insight Forensic
Splitting an imaging session to separate targets
A situation may occur when multi-target imaging is paused to be continued later, but one or more targets become unavailable. The drive may need to be taken and used by another technician or broken, or the server with the image file may become unavailable. But you may need to finish the imaging to the remaining target asap to start working on the evidence.
It is for such cases that we have added the splitting imaging sessions functionality to the 4.9 release of Atola Insight Forensic.
With the source drive connected to Insight, go to Imaging category and view the details of the interrupted imaging session to several targets. If not all target drives and image files are available, it is impossible to simply resume imaging. However it is possible to split the previous imaging session into separate ones: one per each target. To do that click Split all sessions to separate targets link.
Once the session has been split, it is possible to resume imaging to each separate target by clicking Resume button in each target’s Imaging Session.
The resumed imaging session will skip all sectors imaged to the target within the previous session.
This way one can complete imaging to all targets at different times, as they become available.
NB Please note that if a target becomes unavailable during imaging, the process will automatically stop running, and you can try to either resume imaging to all targets, or split imaging sessions should it be necessary.
Insight's Case Management system records every step of data acquisition process saving them into reports grouped by cases.
To view the whole list of cases and their devices:
In the Search and Open Case window you will see the list of all the devices that have ever been connected and identified by your Insight.
It is possible to search for cases using multiple criteria and sort the results ascending or descending in any of the columns.
Please note that it is possible to store multiple devices under the same case number, allowing you to keep track of all devices related to a certain case.
Once a device is selected, you get a preview of the case including device details: when the case was created (i.e. the device was connected to the unit and identified by Insight for the first time), last time it was opened, the device model, serial number and description.
The case opens as a separate port in the Top Bar of the Insight window.