Imaging Cheat Sheet

Imaging pass setting.
When enabled, the imaging engine reads a drive backwards.

Pros:

• disables Read Look-Ahead effect
• reaches damaged areas from the opposite direction

Cons:

• speed decreases due to auto disabling of drive's cache

AFF4 image, RAW image file, or target drive plugged into the unit. Best to use segmented hashing with linear hashing disabled.

E01 is a linear format. It limits the use of Insight's advanced imaging features, e.g. reverse imaging or manual jumps.

Use high-quality short USB3 cables. Longer or lower-quality USB3 cables can produce read errors during imaging.

Imaging pass setting.
When enabled, a source device switches off its read-cache. Disabling read look-ahead decreases speed; but, it can be helpful against damaged drives.

For particularly unstable drives, go to Error Handling tab and add a rule:

• Consecutive errors: 10
• Action: Change imaging direction

Imaging with linear hash: one MD5/SHA1 hash. Imaging with segmented hashes: many hashes of corresponding LBA ranges of the image

The sum of these LBA ranges represents the entire image, though not necessarily in sequential order. You can still prove that the entire image has not been modified by verifying all hashes in a set.

If Automatic Checkup detects a damaged or degraded head, disable the head in the imaging settings for the initial imaging session.

Read more here: Imaging Drives with Damaged Heads

The last pass has a unique feature which does not occur during previous passes: internal auto-reread procedure for error block sector-by-sector. It is defined by an unchangeable Jump size = 1 sector.

How imaging engine works on the last pass:

1. It reads block using Max Block Size pass setting (256 by default)
2. If reading is successful -> proceed to a next non-imaged block
3. If a read error occurs -> re-read the whole error block sector by sector.
4. If a read error occurs and ReadLong setting is enabled -> re-read using ReadLong command.

How it is useful:

1. Make sure the drive is in good condition or learn about the type of damage to make an informed decision about your following steps

2. Prioritize the drive. Diagnostics report tells you if there is any data at all.

3. Use imaging time estimation

Good options:

• target SSD
• target NAS
• network server with RAID

When imaging to network, 10Gbit network connection is highly recommended.

All files contain file data and metadata. Partitions store metadata in specific structures, e.g MFT for NTFS. Metadata includes file name, access/modification datetimes, size, etc.

Imaging all sectors with metadata allows opening the full directory tree including files, without data within them.

Then you can open File Recovery and create an imaging session for specific files you need.
Example: pictures, videos, documents.

If artifact search has been enabled and the output is too large, it may slow down imaging. Try this:

1. Pause imaging
2. Add a new imaging session
3. Disable some or all Artifacts
4. Resume the session

Changing timeout is available only when you create a new session:

1. Pause the currently running imaging (‘Pause’ button)
2. Click 'Add New Session' link
3. Open imaging settings and change timeout of the last pass
4. Resume the imaging session

Important: The resumed imaging session will complement the data imaged prior to the pause with only the sectors that were not yet copied.

When imaging selected files, speed can be low due to a high fragmentation of sectors which belong to the files.

1. Select files and click 'Image checked'
2. Click 'Edit this map'
3. View the fragmented blocks in LBA ranges
4. Click 'Add range'
5. New LBA range will appear at the end of the list
6. Change Start and End LBA of the new range to include most of LBA ranges above