Call us: 10am – 6pm ET

888 540-2010, 416 833-3501

Disk Utilities

Atola Insight Forensic comes standard with a series of utility features for altering drive configurations and stored data. These features are usually used for research purposes, drive preparation for certain actions, or other case-specific tasks. These utilities eliminate the need in additional products used for minor tasks, which makes managing cases more efficient.

Disk Editor

View and modify any sector with a single click of a button. Master Boot Records, FAT/NTFS/ext Boot Sector, HFS headers, NTFS File Record and Index structures are automatically detected and parsed into a human-readable form.

Viewing NTFS record sector

Fill or Erase

Many organizations require that target drives are wiped/erased before they are used to store forensic images. This is usually done to ensure the accuracy of data and, at the same time, verify the destination drive for any errors by overwriting its every sector. Atola Insight wipes drives at their maximum write speed using different methods including filling the drive with a specified HEX pattern, Zero-Fill, Secure Erase, NIST 800-88, and DoD 5220.22-M-compliant wiping:

Various methods of forensic wiping

SSD Trim

We recommend trimming SSD drives used as target media on a regular basis to maximize data transfer speed. Additionally, this module shows how an attached SSD behaves during read operations on trimmed sectors.

SSD trim explains the post-effect occurring with data

Write from File

To restore a drive from an image file, the Write from File feature allows easy file selection (raw, E01 and AFF4 are supported) and creating an identical copy of the original evidence drive. Alternatively, image a specific range of sectors from the file and to a specific location on the target drive by setting the start LBA.

Creating an identical copy of the original drive from an image file

Compare Devices

Compare data stored on any 2 or more devices sector-by-sector. The number of matching and non-matching sectors is listed in real time for reference. This function is used to check whether or not two hard drives are identical.

Finds which sectors differ among devices

Device Features

Access and adjust the following HDD features: Advanced power management, Acoustic management and Read/Write caching via Insight's smooth, user-friendly interface.

Low-level disk control

Device Configuration Overlay (DCO)

Allows reading and adjusting the current device configuration including modification of the drive capacity.

Device Configuration Overlay

Host Protected Area (HPA)

Access and modify the following hard drive parameters using Atola Insight's interface.

HPA access to remove max address limitation

Unclip HPA/DCO

Automatically removes LBA address restrictions set via Host Protected Area (HPA) or Device Overlay Configuration (DCO).

Automatic HPA and DCO removal

Security features

Set and remove ATA passwords quickly and easily. Using this function, you can set and remove the User ATA password (both levels High and Maximum are supported) and change the Master ATA password.

Unknown ATA passwords can be automatically extracted and removed from most hard drives using Atola Insight's Password Removal function (see details).

Manage ATA passwords

Media Recovery

Quickly and easily repair so-called Software Bad Sectors (sectors with damaged ECC field). This feature is generally used for light bad sector repair.

Media recovery

Generate Bad Sectors

Create a bad sector at any specified LBA by entering the sector number and clicking a single button. Reading of such sectors will now result in an Uncorrectable Error. The change is reversible using the Media Recovery feature, however, all data in such sectors will be lost. This feature is generally used for research.

This function may be useful for testing