Troubleshooting

My DiskSense hardware unit does not boot

It is very likely that there is a USB device plugged into the unit, which prevents it from booting properly. Try detaching all USB cables and restart the hardware unit. If that has not worked, follow these steps to fully reset:

1. Power the hardware unit off
2. Detach any cables and devices (including PSU cable, Extension module, all SATA cables, remove all USB devices/cables plugged in, etc.).
3. Leave it powered off for 3-5 minutes to reset fully. A few internal circuits need up to a minute to fully reset, but waiting some extra time may help.
4. Plug in only the power cable (no network/USB/SATA cables yet).
5. Power the system on and check the Unit Status LED on the back side of the unit 15 seconds later.

The previous boot attempt was interrupted and now the unit does not boot

Connect a monitor directly to the unit's HDMI or VGA port. If you see a BIOS message saying Would you like to restore Fastboot on the next boot? (Y/N), it is likely that the previous booting got interrupted at a specific booting moment.

The most straightforward recipe here is to plug a USB keyboard into one of the USB ports and press the N button. After the unit has booted successfully, please restart it again to make sure the next booting cycle is smooth.

How do I reset the IP address of the hardware unit

You can reset DiskSense unit's IP by holding the small IP RST button on the backside. You should keep holding the button until the UNIT STATUS led stops blinking. Then unit's IP must be reset to 192.168.0.188 and 10.0.0.188.

How to change the hardware unit's IP

The system has been designed to work in the most commonly used networks and has IP addresses 10.0.0.188; 172.16.0.188; 192.168.0.188; 169.254.0.188.

If your network has one of these subnets (10.0.0.*; 172.16.0.*; 192.168.0.*; 169.254.0.*), and the IP address ending with 188 is free, you can simply connect the unit to the network. Then run Insight software, select default unit IP ending with 188, and click Insight -> Modify DiskSense Unit IP.

If your network has a different subnet address, follow these steps:

1. Connect your PC to the DiskSense unit with an Ethernet cable.
2. Go to Settings > Network & Internet > Change adapter options.
3. Find the Ethernet connection with the unit, right-click it and click Properties.
4. Find Internet Protocol Version 4 (TCP/IPv4) in the list, select it and click Properties button.
5. Select Use the following IP address option, enter 192.168.0.5 and click OK.
6. Disable other Ethernet and WiFi connections to avoid IP conflicts.
7. Change the IP address to the one you need.
8. If your PC and the unit belong to different subnets, the connection will be lost. Enable it back in Network and Internet.
9. Connect DiskSense unit to your network with an Ethernet cable and run Atola Insight Forensic.

I am able to ping the Insight's hardware unit but cannot connect to it

Here are the possible reasons:

• The unit has two Ethernet ports, but only ETH1 port can be used for interaction with Insight software. Make sure the Ethernet cable is connected to the DiskSense unit's ETH1 port.
• Firewall or anti-malware is blocking the communication (while ping might work, other ports might be filtered). Try disabling firewall/anti-malware and restart Insight software.
• IP address conflict. Please double-check IP address of your PC's Ethernet card. The fourth digit in it must be different from that of the DiskSense unit. So if the DiskSense unit has 192.168.0.188 IP, then PC's IP has to be somewhat different, e.g. 192.168.0.100.
• HASP drivers have not been installed correctly. To verify this, visit localhost:1947 page (it takes up to 5 minutes for the HASP keys to populate after you power the unit on). There is a HASP dongle inside the unit Atola Insight software connects to. If you do not see any HASP keys in the list then this is the problem. Rerun the installation and make sure to click OK in all pop-up windows as one of them should be the HASP installation. This step can be successfully completed only if HASP key is populated in the web browser.
• The router or switch your unit is connected through may not be configured correctly, especially if it is a WiFi router. Try connecting the unit directly to your PC using Ethernet connection. You can use the USB-to-Ethernet adapter included in the package.

Should these steps prove ineffective, try updating your PC's Windows install.

Insight software is stuck in Searching for DiskSense unit window

It appears that your unit's HASP is not detected. Please check if you can still ping DiskSense unit IP address from Windows PC. Then try the following:

1. Open in a web browser http://localhost:1947
2. Click Configuration in the left menu
3. Click Access to Remote License Managers
4. Enable two options:
   • Broadcast Search for Remote Licenses
   • Aggressive Search for Remote Licenses
5. Wait a minute

Remote License Search Parameters must be either empty or contain the DiskSense IP address (the latter is preferable).

I connected DiskSense directly to my PC's second Ethernet cards but I cannot ping it or connect to it.

First and foremost, please check whether you can ping the unit when it is connected directly via your 2nd Ethernet adapter.

1. If ping attempts are unsuccessful, double-check IP address of the Ethernet adapter. It should be in the same subnetwork as the unit. There's a default unit IP set (if you did not change it): 192.168.0.188, 10.0.0.188
2. Check if you have the other network connection and its IP.
3. If the other connection exists, set a static IP address of Ethernet network card into a value belonging to the different subnetwork.
   Examples:
   • Other card's IP on your PC: 192.168.0.5 - set IP to 10.0.0.200
   • Other card's IP on your PC: 10.0.0.5 - set IP to 192.168.0.5
4. Connect to the DiskSense unit specifying its address in Atola Insight Forensic:
   • 10.0.0.188 if you set 10.0.0.200 as the 2nd Ethernet card's IP
   • 192.0.0.188 if you set 192.0.0.5 as the 2nd Ethernet card's IP

Connection losses occur when I use the USB-to-Ethernet adapter (NIC)

Certain platforms have issues with these adapters, and such issues may occur after large amounts of data have been transferred. It may be a USB-related issue: a memory leak in the USB driver which accumulates after a few days of high-speed transfers.

Try replacing the adapter with a similar one:

• ASIX AX88179 chipset
• aRTL8153 chipset

Windows 10 32-bit. hardlock.sys error during installation

It looks like a HASP (dongle) run-time installation issue. You can install the newest run-time following an alternative scenario:

1. Download new HASP run-time version on this page
2. Unzip it
3. Temporarily disable firewall and antivirus
4. Run CMD as Administrator, change the folder to the one with downloaded file (step 1)
5. Execute the following commands:
haspdinst.exe -r -fr -kp -fss -purge
haspdinst.exe -i -fi -kp -fss
6. Launch Atola Insight Forensic

Windows blue screen when launching Atola Insight Forensic

Microsoft updated Windows 10 (October 2020), and it broke the support of the HASP run-time v6.60.

The issue will be fixed in Atola Insight Forensic 4.17. For already released software versions (4.16 and older), please download and install the newest run-time following these steps:

1. Download the newest HASP run-time version
2. Unzip it
3. Run and install HASPUserSetup.exe
4. Launch Atola Insight Forensic

Atola Insight Forensic 5.1 - 5.3 software updates are based on .NET 5. Install the latest version of .NET 5 64-bit Desktop Runtime:

Download .NET Desktop 5.0.17

After database setup, there are missing cases in the Search window.

Most likely, you selected either either incorrect Work Folder or SQL Server.

Insight's database consists of SQL Server data and Work folder files. Large files like imaging maps, file signatures, artifacts, report logs are saved in the Work folder. While the case information, including report data, is stored on an SQL Server.

Two Insight settings refer to that:

• Work folder
• Database connection settings

\\networkpath\Atola is the work folder we need. First of all, it must be specified in the Insight -> Preferences -> Work folder path setting.

Also, it is important to find corresponding SQL Server database. If you know the names of the computer, SQL server and database, follow these steps.

1. Open Insight -> Database Connection Settings
2. Select server type: Remote (in some cases it can be Local)
3. Enter Computer name from the work folder's network path
4. Click Search link in front of SQL server name field
5. Select one of the found SQL servers
6. Click Search link in front of Database name field
7. Select one of the found databases
8. Click OK
9. Restart Atola Insight Forensic software
10. Check Cases -> Search/Open for your cases

If cases do not appear, try different combinations of database name, SQL server name, computer name.

How do I change the path to the Work Folder?

To change the path to the Work Folder, go to Insight > Preferences > Work folder path, change the directory and click the Apply button.

I am running out of free storage space in Work folder

Depending on the features and the settings you use, Insight saves different kinds of data in its Work Folder.

• Make sure to disable an on-the-fly artifact search in the imaging settings. The space is most aggressively consumed when artifact search is enabled. When the artifact search is enabled in the imaging settings, you may be gathering and storing substantial amounts of data.
• The same goes for File Signatures. Disabling this setting results in much less data being stored, yet it may accumulate and become considerable over time. This setting can be disabled in the Miscellaneous tab of the imaging settings.
• Last but not least, if you no longer need results of a previously performed artifact search, you can delete all ArtifactFinder subfolders to free up space. ArtifactFinder subfolders are located at paths similar to this: C:\Atola Insight Forensic\Work\02_ST1500DM003\ArtifactFinder, where:
  • C:\Atola Insight Forensic\Work - work folder path
    
  • \02_ST1500DM003 - subfolder of device case

After I changed the Work folder, files from the previously created cases have not been moved to the new folder

This can be done manually:

1. Click Case Number button in the top right corner.
2. Change Case Details window opens and Case Home Path in it indicates the directory where case files will be moved.
3. Click OK. Case Home Path has now been changed in the database and all case files are moved to the new case folder.

Mapped network drive is unavailable during Image File selection

The shared folder mapped as a network drive to the local PC is unavailable. The issue happens in Windows 10 and is caused by Microsoft's native components we use to select files.

Microsoft explains this with UAC being enabled and suggests editing the Windows registry as a workaround.

NB the mapped network drive is just a shortcut for the longer network path. Always select Network part of tree view and select the same network folder. Insight will remember the last selected path and open it when you select another image file.

Insight can't identify a Seagate drive and shows an inaccurate device capacity

Zero-capacity implies typically firmware issues which may be corrected via serial port in the case of Seagate drives. Atola Insight Forensic enables to take advantage of serial connection.

We do not have many guides about fixing specific Seagate issues, which would require a profound knowledge of Seagate terminal command system. But here is another article in the manual that may be helpful.

Seagate. Turn off bad sector reallocation (or clear G-LIst)

Unfortunately, Insight does not handle bad sector reallocation automatically. You may find more info on data recovery forums by searching for:

• your Seagate drive model
• G-List cleaning
• bad sector reallocation

Here is the information about terminal commands for modern Seagate drives.

Artifact finder does not find artifacts in files (.pdf, .pst, .docx, etc.)

Artifact finder performs low-level sector-by-sector search without parsing file structure and interpreting each type of file (.pdf, .pst, .docx).

Instead, Insight's search engine detects keywords, IP addresses, URLs, and other artifacts in raw drive space. This way, it complements the traditional analysis via Magnet AXIOM, X-Ways Forensics, etc.

Another benefit of Insight's artifact search: it goes through the whole drive space, including unallocated space. It helps find evidence at the sector level, where other tools could miss it.

I don't seem to be able to unlock an SSD or a USB drive with Insight

Insight supports unlocking passwords of a limited range of drives. While we would like to provide you with maximum support, it is impossible due to the firmware of different drive families being very vendor-specific. Please check the list of supported drives.

We have primarily developed this functionality for hard drives, but extending this functionality for SSDs or USBs would require a prohibitive amount of work to support the huge range of firmware types and controllers. Unfortunately, this functionality has not been the focus of our attention.

Encase does not open an E01 file created by Insight

E01 files have a problem opening in Encase typically due to a file handle held by Insight. It can manifest itself in CRC errors during Encase verification. To resolve it, close the E01 file's port in the top panel in Insight before opening the file in Encase.

It helps to know that Encase caches unsuccessful verification results for the E01 file (or E01 file with the same metadata). So it may be necessary to clear the cache or start a new case in Encase application.

Max path length / folder length

Make sure that the path length has not exceeded the limit set in Windows API.

Atola Insight supports the maximum path of 32,767 characters.

Since you are not able to move the files using Windows Explorer, you can take advantage of subst command to shorten the file path for the file(s). Here is the easiest way to fix this:

1. Substitute the folder that has a long file path with a drive letter
   (thereby shortening the overall character count for the files contained in the folder)
2. Copy or move the files out of the folder into another folder that won't violate the limit
3. Delete the mapped folder

A USB drive imaging produces read errors

To eliminate the possibility of faulty cables, it may be worth investing in short, high-quality USB3 cables. Longer, lower-quality USB3 cables can produce read errors during acquisition.

Non-working USB flash or USB port

It's very unlikely you have a faulty DiskSense system. Moreover, bearing in mind all USB ports are native motherboard ports without any adapters in between. Nevertheless, let's try to make diagnostics and find out what works and what does not:

1. Remove all USB flash drives
2. Power cycle the DiskSense system to get USB ports into their initial state
3. Take a new USB flash stick which is good and working
4. Plug it into USB Target 1 port
5. Press F4 and wait till target device scanning finishes
6. Plug the same USB flash stick into USB Target 2 port
7. Press F4 and wait till target device scanning finishes
8. Plug the same USB flash stick into USB Target 3 port
9. Press F4 and wait till target device scanning finishes
10. Plug the same USB flash stick into USB Source port
11. Press F3 and wait till source device scanning finishes

This is a clear test for USB ports. It would be great if you can run the scenario several times with different USB flash drives. Pay attention that the 2nd step (power cycle the DiskSense system) is a must to have clear test results.

Serial COM port (RS-233). Unlock problem

First and foremost, I would ask to double-check whether the serial cable connection and selected baud rate are correct. Here is the easiest way:

• Power off Seagate drive
• Connect cables
• Open Windows -> Terminal
• Select baud rate = 38400 (most probable for modern drives)
• Power on the Seagate drive