Atola Blog

Diagnostics report
Atola TaskForce

Diagnose a drive with Atola TaskForce

When an evidence drive lands on investigator’s table for the first time, there is always an uncertainty when it comes to the drive’s condition. A broken head or scratched surface of the media require different imaging tactics. That’s why it is strongly suggested that before imaging, each drive should first be diagnosed.  TaskForce has Atola’s unique diagnostics module which checks all systems of the drive: Hard drive’s motor and electronics (PCB) Head stack Media surface All firmware/system areas Partitions and file systems At the end the system produces a report which sums up all issues. The process will take only 2 – 5 minutes.  To start, click Diagnostics button in the Read more…

By Yulia Samoteykina, ago
Atola TaskForce

Atola TaskForce’s connectivity and multi-user access

Atola TaskForce has three connectivity options: 10Gb Ethernet network Standalone mode WiFi access point 10Gb Ethernet network Atola TaskForce is equipped with two 10Gb Ethernet ports. Whenever the system is connected to a local network via one of its Ethernet ports, an IP address will be displayed on the IP screen on the front panel of the system. If the system is connected via both Ethernet ports, two IP addresses will be displayed on the screen. These IP addresses are assigned to TaskForce by your DHCP server. Multi-user access With the help of these IP addresses, TaskForce can be operated by multiple users from their workstations or mobile devices: enter Read more…

By Yulia Samoteykina, ago
Multi-user access
Atola TaskForce

Running 8 or more tasks on TaskForce

So how exactly does Atola TaskForce perform 12 or more imaging sessions or other long-running tasks (hashing, wiping, etc.)? Multiple processes can run in parallel thanks to TaskForce’s high-capacity hardware. TaskForce is a forensic hardware that has a 8-thread Xeon CPU. Each of the threads backs imaging at the speed of 550 MB/sec (or faster on SAS and extension ports). Should a drive’s native speed be lower than that, the respective thread’s capacity is freed up for more workload. It means that you can launch more than 8 tasks at a time: 10, 12 or 15 with no negative affect on individual performance. For instance, if one of the eight Read more…

By Yulia Samoteykina, ago
Atola TaskForce

We are launching Atola TaskForce. The revolution is here

We are very pleased to announce the official launch of our new fantastic product – Atola Taskforce. What is Atola TaskForce? It all starts with a routine problem. The problem that people face every day spending more and more effort to solve. During our conferences and private communications with customers throughout the last 3 years, we found the most critical issue is: Evidence acquisition time that has been increasing every year Atola TaskForce is designed to solve this challenge. TaskForce enables the simultaneous imaging of 8 or even more drives reaching the total performance of 15 TB per hour. This new power hides in hardware that has the compact dimensions of Read more…

By Vitaliy Mokosiy, ago
SSD imaging speed
Atola Insight Forensic

The speed of imaging with Atola Insight Forensic

As we travel to exhibit at forensic events worldwide, we usually bring some of the fastest SSDs (usually Samsung 850 Pro) with us to show the speed at which they can be imaged with Atola Insight Forensic (on these drives, it constitutes around 500 MB/s). At the same time, we feel that in this blog we have missed the opportunity to demonstrate exactly how fast Insight can image different types of hard drives, solid-state drives, USB flash memory, etc. We test our units on a wide range of storage devices. This time we imaged a few of them and cross-checked the speed with userbenchmark.com, where you can find detailed info on the Read more…

By Yulia Samoteykina, ago
Imaging artifacts on the fly
Atola Insight Forensic

Artifacts: Image & analyze on the fly

Imaging is a time-consuming part of the evidence acquisition process, especially when dealing with damaged drives. Even though Atola Insight Forensic is the fastest forensic imaging tool in the world (there is literally no penalty on a drive speed when you image it with Insight!), we want to help expedite forensic process even further. That is why our team of engineers has developed the artifact search feature, which allows analysis of data from an evidence device during imaging. Artifacts settings 1. Go to Imaging category of the left-side menu 2. Click Create new session link and select the target device 3. In Preset line click Show settings link 4. Open the Read more…

By Yulia Samoteykina, ago
Atola Insight Forensic

Atola Insight Forensic 4.10 – Search of forensic artifacts in the course of imaging

On December 5 Atola Technology releases Atola Insight Forensic 4.10. The key feature is the search of artifacts capability while imaging a source evidence media. It allows to search the source drive for credit cards, emails, URLs, IPs, GPS coordinates, phone numbers, keywords etc. in the course of imaging. This feature will help forensic specialists expedite investigation in urgent cases or when dealing with a damaged drive that takes hours to image. The full list of Atola Insight Forensic 4.10 changes can be found here: Atola Insight Forensic Changelog. Imaging settings now have a new Artifacts tab where different types of artifacts can be selected and lists of keywords or regular expressions can be Read more…

By Yulia Samoteykina, ago
Artifact search
Atola Insight Forensic

Calculating segmented hash of a damaged drive

When you work with a damaged device, and imaging can only be performed in multiple passes due to bad sectors or physically damaged areas or heads, it is impossible to calculate linear hash of the drive. This can become a serious challenge if you need to prove evidence integrity in the court of law. And it is for such cases that Atola Insight Forensic has Segmented hashing functionality. According to the recommended workflow, run Automatic checkup of the evidence drive. If the drive has hardware or bad sector issues, it is likely that imaging will not be completed within one pass, and you can calculate the hash for such drive only Read more…

By Yulia Samoteykina, ago
Atola Insight Forensic

Tracking a drive’s SMART table status before and after imaging

Being able to evaluate the drive’s state before it has exhausted its resources can make all the difference between a case won or a case lost in a court of law. SMART table is a valuable source of information about a hard drive’s health. SMART (Self-Monitoring, Analysis and Reporting Technology) provides stats of a drive’s operation, thus helping predict its future failure. Making a definitive conclusion based on the indices in SMART table is not easy: not all parameters are critical, it is usually a combination of bad values of a few parameters that point to a trouble, time factor plays a role too (how fast has the state of Read more…

By Yulia Samoteykina, ago