Artifacts settings<\/h3>\n
1. Go to Imaging <\/em>category of the left-side menu In this tab it is possible to view, select or deselect the artifacts you want to be searched in the course of imaging.<\/p>\n For each of these artifacts we have not only applied well-known algorithms including the Luhn\u00a0formula\u00a0used to validate credit card numbers, but also applied our own smart filters to eliminate false results (e.g. if there are two slashes near the number that has preliminarily been identified as a credit card number, that will eliminate it from the search results, as it is likely to be a part of a URL).<\/p>\n Keywords and regular expressions can be added to the search parameters in a txt file with one artifact per line. Click the View link next to Keywords<\/em> category in Artifacts<\/em> tab before imaging and make sure the keywords are displayed correctly. Keyword encoding can be adjusted to Unicode, Unicode (UTF-8), Unicode (Big-Endian) <\/em>or US-ASCII.<\/em><\/p>\n A few of the artifacts are selected by default, namely: GPS, MAC, Phone numbers, URL<\/em>. You can adjust these default settings and click Save settings<\/em> button. This will affect all future imaging sessions (including those on new source drives) unless you re-adjust the settings or restore the default settings by clicking the corresponding link. The paths to the files with keywords and regular expressions will also remain saved, although should any changes by made to the txt files in the saved directory, the changes will be uploaded at the start of each imaging session.<\/p>\n NB.<\/strong> It is advisable that no more than 4 artifacts are selected at a time, otherwise imaging will slow down considerably. Also, keywords consisting of less than 4 symbols or regular expressions consisting of less than 6 symbols; large number of keywords (more than 2000) or regular expressions (more than 10) may also slow down imaging process. This is due to the large number of results such search parameters are capable of producing.<\/em><\/p>\n Once you have ticked the boxes next to the artifacts you would like to be searched for, click Start Imaging<\/em> button.<\/p>\n Once imaging has begun, go to the Artifacts<\/em> tab in the bottom part of Insight window and watch the selected artifacts being found: the numbers of artifacts and the corresponding diagram\u00a0change\u00a0on the go.<\/p>\n To see the artifacts in a list, press on any of the categories or the diagram.<\/p>\n In the table, each artifact is assigned an Id<\/em> number, each found Value<\/em> is shown in the context (including 20 bytes before and 20 bytes after the artifact in grey color), the LBA<\/em> and the offset<\/em> are also displayed in the table to help locate the artifact.<\/p>\n There are many options to help find, sort, filter and view the artifacts: it is possible to view one or a few categories of artifacts in one list, use the Search<\/em> bar to find a specific value (search examples are provided in the bottom right corner of the window), filter results for unique values by clicking the Show unique artifacts<\/em> link.<\/p>\n The latter option is quite valuable as it helps identify the values most frequently occurring on the drive: to sort the results click Count<\/em> in the table header.<\/p>\n To promptly find the sector where an artifact is located, you can double click the artifact you would like to examine more thoroughly.<\/p>\n Export to CSV<\/em>\u00a0button is disabled during imaging. You can wait until imaging is completed or pause it, make an export and restart imaging, should it be necessary to start analyzing the current artifact search output with an external tool:<\/p>\n 1. Pause<\/em> imaging. There is Export artifact<\/em> link now in the Imaging<\/em> category of Insight’s menu. If the source drive was imaged in multiple sessions, and artifact lists were created during different imaging sessions, by clicking this link you can download a merged list of artifacts from multiple imaging sessions.<\/p>\n Imaging is a time-consuming part of the evidence acquisition process, especially when dealing with damaged drives. Even though Atola Insight Forensic is the fastest forensic imaging tool in the world (there is literally no penalty on a drive speed when you image it with Insight!), we want to help expedite […]<\/p>\n","protected":false},"author":8,"featured_media":2221,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[35],"tags":[],"yoast_head":"\n
\n2. Click Create new session<\/em> link and select the target device
\n3. In Preset<\/em> line click Show settings<\/em> link
\n4. Open the Artifacts<\/em> tab.<\/p>\n![\"\"](\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/11\/1-imaging-settings-artifacts.png\")
<\/p>\n![\"\"](\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/11\/2-imaging-settings-artifacts-encoding.png\")
<\/p>\nBrowsing through the artifacts in the course of imaging<\/h3>\n
![\"\"](\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/11\/3-imaging-artifacts.png\")
<\/p>\n![\"\"](\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/11\/4-artifact-list-categories.png\")
<\/p>\n![\"\"](\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/11\/5-artifact-frenquency-list.png\")
<\/p>\n![\"\"](\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/11\/6-sector-and-list.png\")
<\/p>\nExporting artifacts<\/h3>\n
\n2. In the Imaging results<\/em> page click on Artifacts<\/em> link.
\n3. In the Artifacts<\/em> page you can select the artifacts you would like to be exported (e.g. one or multiple artifact categories, unique artifacts or only those fitting certain search criteria), and then click Export to CSV file<\/em> button.
\n4. Select the path for the file and click Export<\/em>
\n5. Once the export is completed (which normally takes no longer than a few seconds), restart imaging.<\/p>\n![\"\"](\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/11\/7-imaging-sessions-export-artifacts.png\")
<\/p>\n","protected":false},"excerpt":{"rendered":"