Accurately assessing the state of a hard drive and finding the exact points of damage will determine the approach taken to successfully complete the data acquisition.
With traditional forensic tools you never really know the true state of the media you work with. This means that most data acquisitions are based on an assumption that everything is fine.
This approach works most of the time, until you have a case where the hard drive just stops working in the middle of an imaging session, and after a few hours of poking around you have to conclude: that evidence drive is dead.
Atola Insight Forensic is the only commercially available tool that can automatically diagnose a hard drive and pinpoint the exact failure (if any), and suggest the best course of action.
The tool automatically diagnoses hard disk electronics, motor, heads, media surface, firmware, and even file systems, and provides a clean and easy to read report.
The Atola Insight Forensic is able to accurately diagnose hard drives that cannot be recognized or identified by any system including the vast majority of disk imaging, data recovery, and data acquisition products, even the most sophisticated ones. In cases where the Atola Insight cannot recognize the hard drive, it can still diagnose the drive by sensing the SATA PHY status, sending low-level, vendor-specific commands into the HDD, and interpreting electrical currents.
Here's how this works: Atola Insight applies power to the hard drive and immediately starts sampling its startup currents. Then, comparing the startup currents to the internal database it can detect a specific failure.
Virtually any defect can be successfully diagnosed using this approach: head stack failure, motor damage, electronic board damage, etc. Since the method relies solely on start-up currents and nothing else, the hard drive does not have to be operational for successful diagnosis.
The Atola Insight's automatic diagnostics function evaluates the state of the hard drive, identifies specific errors and then recommends steps for moving forward with HDD recovery and data extraction. This is the starting point for all data recovery or acquisition cases. The operator simply plugs the damaged hard drive into the DiskSense unit and clicks a single button to start the automatic checkup. Real-time status updates are displayed throughout the diagnosis and a full diagnostic report is then generated in less than 5 minutes.
This engine identifies damage in the following areas:
The Atola Insight's Media Scan function displays read-speed for any range of sectors in both milliseconds and megabytes per second. This information enables the operator to assess damaged sectors and read/write heads by analyzing read delays. The color-coded graphic display lists the current read speed, average speed throughout the scan, and number of read errors found (updated in real time). The scan can be set to read sectors in linear (forward) order or backward order. Additionally, a "Fast Scan" mode is available, which reads small select areas throughout the entire media to save time.
The Media Scan #1 screenshot shows a drive with degraded Head 6.
The Media Scan #2 screenshot shows a pattern of severe read delays and several unreadable sectors. This specific type of pattern strongly indicates head failure, where blocks being read by some heads show no delays and blocks being read by other heads are unreadable or show significant delays.
Note: The Atola Insight is also able to identify head damage through its Automatic Checkup function.
The Atola Insight comes equipped with a Dual Oscilloscope that monitors the 5 volt and 12 volt currents being drawn by the hard drive in real time. This feature gives the operator the ability to track the electrical behavior of the hard drive throughout the entire data recovery process. Any major changes or inconsistencies can then be identified as soon as they occur. This tool is very important to data recovery technicians for the same reason that a heart-rate monitor is important to medical doctors. When a patient is in unstable condition, the doctor must be able to keep track of the patient's vital signs and know immediately if a complication occurs.
In data recovery, it is quite common for a hard drive to have multiple issues. In some cases, the Atola Insight will identify multiple failures at once. In others cases, only one failure will show up during the first diagnosis and further issues will become visible as the recovery process goes on.
For example, if a hard drive has experienced failure in both the PCB and firmware area, only the damage in the PCB will be identified at first because the PCB is needed to relay electrical signals from the hard drive in order to detect firmware damage. Once the PCB is repaired, the HDD will need to be diagnosed a second time in order to identify the damage to the firmware area.
Click questions to expand text
The automatic diagnostic function applies a sophisticated system that analyzes electrical currents as they enter and leave the hard drive, examines the hard drive’s responsiveness to low level commands and incorporates firmware information (if it is accessible). Our studies had shown that this approach is accurate in pinpointing malfunctions in at least 95% cases.
Some data from the oscilloscope is very simple to understand (for example; when HDD power fails the lines go flat). Users can learn to understand more complex oscilloscope information by seeking advice from other data recovery technicians, seeking professional training, or simply through gaining experience in field.
While current monitoring technology plays an important role in the Atola Insight’s operation, no specific skills are actually required since the current analysis is performed automatically by the tool.
The Atola Insight will only diagnose the hard drive that is directly connected to the DiskSense unit. Hard drives from RAID Arrays must be diagnosed and recovered individually.