Call us: 10am – 6pm ET

888 540-2010, 416 833-3501

File Recovery

File Recovery is the part of the Atola Insight Forensic system that provides file extraction capabilities for both good and damaged drives. It supports all versions of the most popular operating systems: Windows, Mac OS X and Linux.

Supported file systems:
NTFS, APFS (with encrypted volumes), Ext 2/3/4, HFS, HFS+, ExFAT, FAT16, FAT32

Recovery of deleted files supported for:
NTFS (all versions), FAT16, FAT32, HFS, HFS+, HFSX

File recovery

File recovery

Benefits of an all-in-one solution

While being a very powerful tool on its own, the File Recovery module in Atola Insight Forensic has even more power with the help of a tight integration with the imaging module – the process for disk imaging.

During the imaging process, Insight not only copies data from one disk to another, but also analyzes the data and saves information about copied sectors and errors which were found on the source device. This information is used in File Recovery to find and extract a file's data and to provide additional information regarding file status.

Start by selecting the media

Atola Insight Forensic allows the user to select any supported media item attached to the DiskSense unit or host computer for file recovery. The user can also select any image file stored on any attached media item. Searching for attached media and selecting an item for recovery is quick and easy.

Status for each file

When a disk is imaged using Atola Insight Forensic, the File Recovery is able to show status of each file in the file browser, such as what percentage of file was imaged without errors. With just a glance you can see which files are damaged and to what degree.

File status

File status

File lists

Atola Insight Forensic has the ability to create lists of files specifying the status of each file. After creation, the list may be presented to the examiner for a review, and the examiner will be able to tell whether all their important files are fully recovered or not.

Creating list of imaged files

Creating list of imaged files

File map

It is now very easy to find out the exact part of a file that wasn't imaged correctly. With one click, you have access to the file's sector map. In this map, you will see a color-coded representation of all the parts of the file that were imaged correctly as well as the parts that were not imaged due to bad sectors, etc. It allows you to very quickly estimate the file's "health" and re-attempt imaging of the specific sectors of a file if needed.

8 bad sectors belong to lastlog file

8 bad sectors belong to lastlog file

Hash list

This feature allows to import text files containing huge lists of file hashes. Those can be treated as white or black hashes. The idea behind these types is simple:

  • White hash term stands for a known good file created by known software.
  • Black hash means some known bad file. It could be a malware, hacking script, hidden illicit data file.

Having hash lists imported to Atola Insight DB, File Recovery analyzes every calculated file hash against the database. If file hash belongs to either white or black hash list, special marks are shown on the left of file hash values.

Example: Picture below shows Black and Unknown hash filters activated. Thus, more than 1300 White hash files from "/usr/bin" folder are filtered out. So you can notice there are two suspicious files in the end.

Black and Unknown hash filters activated

Black and Unknown hash filters activated

Powerful forensic file search

File Recovery possesses advanced search capabilities helping to quickly find files you need. The search file mask includes wildcards as well as regular expressions. Search results are filtered by various conditions/filters that can be easily combined:

Each of these can be specified many times with different values and operation (more/less than, equals, between, etc.)

Search by file hash set and date range

Search by file hash set and date range

Effective reporting

After File Recovery is complete, a full report is automatically created listing files successfully recovered, files not successfully recovered, and files with skipped sectors. This report is automatically stored in the Atola Insight's case management system.

Frequently Asked Questions

Click questions to expand text

Does the speed of the DiskSense unit affect the speed of file recovery?