File Recovery is the part of the Atola Insight Forensic system that provides file extraction capabilities for both good and damaged drives. It supports all versions of the most popular operating systems: Windows, Mac OS X and Linux.
Supported file systems:
NTFS, APFS (with encrypted volumes), Ext 2/3/4, HFS, HFS+, ExFAT, FAT16, FAT32
Recovery of deleted files supported for:
NTFS (all versions), FAT16, FAT32, HFS, HFS+, HFSX
While being a very powerful tool on its own, the File Recovery module in Atola Insight Forensic has even more power with the help of a tight integration with the imaging module – the process for disk imaging.
During the imaging process, Insight not only copies data from one disk to another, but also analyzes the data and saves information about copied sectors and errors which were found on the source device. This information is used in File Recovery to find and extract a file's data and to provide additional information regarding file status.
Atola Insight Forensic allows the user to select any supported media item attached to the DiskSense unit or host computer for file recovery. The user can also select any image file stored on any attached media item. Searching for attached media and selecting an item for recovery is quick and easy.
When a disk is imaged using Atola Insight Forensic, the File Recovery is able to show status of each file in the file browser, such as what percentage of file was imaged without errors. With just a glance you can see which files are damaged and to what degree.
Atola Insight Forensic has the ability to create lists of files specifying the status of each file. After creation, the list may be presented to the examiner for a review, and the examiner will be able to tell whether all their important files are fully recovered or not.
It is now very easy to find out the exact part of a file that wasn't imaged correctly. With one click, you have access to the file's sector map. In this map, you will see a color-coded representation of all the parts of the file that were imaged correctly as well as the parts that were not imaged due to bad sectors, etc. It allows you to very quickly estimate the file's "health" and re-attempt imaging of the specific sectors of a file if needed.
This feature allows to import text files containing huge lists of file hashes. Those can be treated as white or black hashes. The idea behind these types is simple:
Having hash lists imported to Atola Insight DB, File Recovery analyzes every calculated file hash against the database. If file hash belongs to either white or black hash list, special marks are shown on the left of file hash values.
Example: Picture below shows Black and Unknown hash filters activated. Thus, more than 1300 White hash files from "/usr/bin" folder are filtered out. So you can notice there are two suspicious files in the end.
File Recovery possesses advanced search capabilities helping to quickly find files you need. The search file mask includes wildcards as well as regular expressions. Search results are filtered by various conditions/filters that can be easily combined:
Each of these can be specified many times with different values and operation (more/less than, equals, between, etc.)
After File Recovery is complete, a full report is automatically created listing files successfully recovered, files not successfully recovered, and files with skipped sectors. This report is automatically stored in the Atola Insight's case management system.
Click questions to expand text
The speed of the DiskSense unit affects the speed of scanning the entire hard drive as well as the speed of file restoration. Please note that the hard drive does not need to be scanned by the File Recovery module if it has already been duplicated/imaged using the Atola Insight Forensic because the Disk Imaging module automatically creates all data structures for the File Recovery module to reference..