Imaging Cheat Sheet

When source drive is damaged

Use these imaging settings and follow the recommendations to cope with severely damaged drives.

Reverse direction
Imaging pass setting.
When enabled, the imaging engine reads a drive backwards.

  • disables Read Look-Ahead effect
  • reaches damaged areas from the opposite direction
  • speed decreases due to auto disabling of drive's cache
Optimal target types for damaged source device

AFF4 image, RAW image, or target drive plugged into the unit Best to use segmented hashing with linear hashing disabled.

E01 is a linear format. It limits the use of Insight's advanced imaging features, e.g. reverse imaging or manual jumps.

USB drive read errors
Use high-quality short USB3 cables. Longer or lower-quality USB3 cables can produce read errors during imaging.
Disable read look-ahead
Imaging pass setting.
When enabled, a source device switches off its read-cache. Disabling read look-ahead decreases speed; but, it can be helpful against damaged drives.
Effective error handling rule
For particularly unstable drives, go to Error Handling tab and add a rule:
  • Consecutive errors: 10
  • Action: Change imaging direction
Segmented hashes

Imaging with linear hash: one MD5/SHA1 hash. Imaging with segmented hashes: many hashes of corresponding LBA ranges of the image

The sum of these LBA ranges represents the entire image, though not necessarily in sequential order. You can still prove that the entire image has not been modified by verifying all hashes in a set.

Damaged head
If Automatic Checkup detects a damaged or degraded head, disable the head in the imaging settings for the initial imaging session.

Read more here: Imaging Drives with Damaged Heads
Last imaging pass explained

The last pass has a unique feature which does not occur during previous passes: internal auto-reread procedure for error block sector-by-sector. It is defined by an unchangeable Jump size = 1 sector.

How imaging engine works on the last pass:

  1. It reads block using Max Block Size pass setting (256 by default)
  2. If reading is successful -> proceed to a next non-imaged block
  3. If a read error occurs -> re-read the whole error block sector by sector.
  4. If a read error occurs and ReadLong setting is enabled -> re-read using ReadLong command.

Faster imaging

If you want to speed up image acquistion, follow these hints.

Diagnose source before imaging

How it is useful:

1. Make sure the drive is in good condition or learn about the type of damage to make an informed decision about your following steps

2. Prioritize the drive. Diagnostics report tells you if there is any data at all.

3. Use imaging time estimation

Use faster targets
Good options:
  • target SSD
  • target NAS
  • network server with RAID

When imaging to network, 10Gbit extension is highly recommended.

All sectors with metadata

All files contain file data and metadata. Partitions store metadata in specific structures, e.g MFT for NTFS. Metadata includes file name, access/modification datetimes, size, etc.

Imaging all sectors with metadata allows opening the full directory tree including files, without data within them.

Then you can open File Recovery and create an imaging session for specific files you need.
Example: pictures, videos, documents.

Disable Artifact Finder
If artifact search has been enabled and the output is too large, it may slow down imaging. Try this:
  1. Pause imaging
  2. Add a new imaging session
  3. Disable some or all Artifacts
  4. Resume the session
Change imaging pass timeout on-the-fly
Changing timeout is available only when you create a new session:
  1. Pause the currently running imaging (‘Pause’ button)
  2. Click 'Add New Session' link
  3. Open imaging settings and change timeout of the last pass
  4. Resume the imaging session

Important: The resumed imaging session will complement the data imaged prior to the pause with only the sectors that were not yet copied.

Use Media Map Manager
When imaging selected files, speed can be low due to a high fragmentation of sectors which belong to the files.
  1. Select files and click 'Image checked'
  2. Click 'Edit this map'
  3. View the fragmented blocks in LBA ranges
  4. Click 'Add range'
  5. New LBA range will appear at the end of the list
  6. Change Start and End LBA of the new range to include most of LBA ranges above
Back to Manual start page