{"id":2019,"date":"2017-12-05T16:30:41","date_gmt":"2017-12-05T14:30:41","guid":{"rendered":"http:\/\/blog.atola.com\/?p=2019"},"modified":"2026-05-06T07:34:15","modified_gmt":"2026-05-06T05:34:15","slug":"atola-insight-forensic-4-10-search-of-forensic-artifacts-in-the-course-of-imaging","status":"publish","type":"post","link":"https:\/\/atola.com\/blog\/atola-insight-forensic-4-10-search-of-forensic-artifacts-in-the-course-of-imaging\/","title":{"rendered":"Atola Insight Forensic 4.10 – Search of forensic artifacts in the course of imaging"},"content":{"rendered":"

On December 5\u00a0Atola Technology releases Atola Insight Forensic 4.10<\/em>.<\/p>\n

The key feature is the search of artifacts capability while imaging a source evidence media. It\u00a0allows to search the source drive for credit cards, emails, URLs, I<\/span>P<\/span>s<\/span>, GPS coordinates, phone numbers, keywords<\/em> etc. in the course of imaging.\u00a0This feature will\u00a0help forensic specialists expedite investigation in urgent cases or when dealing with a damaged drive that takes hours to image.<\/p>\n

The full list of Atola Insight Forensic 4.10 changes can be found here: Atola Insight Forensic Changelog<\/a>.<\/p>\n

Imaging settings now have a new Artifacts<\/em> tab where different types of artifacts can be selected and lists of keywords or regular expressions can be uploaded.<\/p>\n

\"\"

Atola Insight Forensic: Artifacts tab<\/p><\/div>\n

For each of the artifacts, we have not\u00a0simply applied well-known algorithms (e.g. Luhn formula used to validate credit card numbers). We have developed our own smart filters to eliminate false results (e.g. if there are two slashes near the number that has preliminarily been identified as a credit card number, that will eliminate it from the search results, as it is likely to be a part of a URL).<\/p>\n

We have added a new Artifacts<\/i> tab in the bottom part of Insight\u2019s imaging <\/i>window: the numbers of the found artifacts and the corresponding diagram change on the go.<\/p>\n

\"\"

Atola Insight Forensic: Imaging data<\/p><\/div>\n

The list of found artifacts is opened by a click on any of the categories or the diagram itself.<\/p>\n

In the table, each artifact’s\u00a0Value<\/em> is shown in the context (including 20 bytes before and 20 bytes after the artifact), the LBA<\/em> and the offset<\/em> are also displayed in the table to help locate the artifact.<\/p>\n

There are many options to help find, sort, filter and view the artifacts: it is possible to view one or a few categories of artifacts in one list, use the search bar to find a specific value, filter results for unique values by clicking the Show only unique artifacts <\/i>link.<\/p>\n

The latter option is quite valuable as it helps identify the values most frequently occurring on the drive. It often accelerates the whole process of specific artifact search.<\/p>\n

\"\"

Atola Insight Forensic: artifact search<\/p><\/div>\n

For more information about the Artifacts<\/i> feature please read our next week\u2019s blog post or follow this link to our manual:
\nhttps:\/\/atola.com\/products\/insight\/manual<\/a><\/p>\n

Where to buy<\/h3>\n

If you still do not have an Atola Insight Forensic<\/em> and would like to place an order, this can be done directly via Atola Technology, or from a distributor near you:<\/p>\n

https:\/\/atola.com\/wheretobuy\/<\/a><\/p>\n

Please contact our Atola Technology sales to receive more specific information:<\/p>\n