Step 1. Plug the source and target devices into the DiskSense 2 hardware unit.

Take two SATA drives that will serve as your source and target devices. Plug them into the SATA source and SATA target ports.

Step 2. Launch Atola Insight.

Launch already installed Atola Insight Forensic software.

You will see the following window requesting that you select the desired action:

Select Close to avoid powering up the source SATA port for now.

Step 3. Diagnose first before imaging.

Presumably, we know nothing about the source device and its state. Maybe it is a good working drive, or maybe it is not. It may be a damaged one or it may die in a few hours. That is why we should begin with Automatic Checkup.

Go to Diagnostics > Automatic checkup, and then click the Start button.

It will take a couple of minutes to get to the Diagnostics report. In this particular case, we see that the source drive is in good state, and we can safely start imaging it.

Step 4. Select the imaging targets.

On the left, click Imaging and then Create New Session. You will be asked to select the imaging targets, including the following:

• Devices plugged into SATA/USB target ports of the DiskSense system
• Image files

Let us take advantage of imaging into two targets at the same time: SATA target drive and image file.

Click Create Image File and then confirm a selected filename. Then select the SATA Target 1 device. In the end, you will get a screen like this:

Click the Select button to confirm.

Step 5. Start imaging.

Imaging includes a wide variety of settings for tuning the process. Sometimes it is helpful when dealing with severely damaged evidence drives. However, the default imaging preset works great in most cases.

Here is just one button to click, Start Imaging, to get the imaging process running.

Bonus: Screencasts

Congratulations! You read the quickstart up to this section, and we have an award for you! :-) Here are a number of screencasts explaining specific features of Atola Insight Forensic.

• Download or watch in high-resolution on Dropbox
• Watch on Youtube

1. Media diagnosis

Whenever you start working on a hard drive, the very first thing we recommend to do is to find out if the drive is damaged in any way, and if so, what is the extent of the damage.

The tool comes with fully automated hard drive diagnosis module. It diagnoses all hard drive components:

• printed circuit board (PCB),
• spindle motor,
• head stack,
• firmware,
• and file systems.

After diagnostics finishes, the tool will prepare a report and let you know the exact issue with the drive; it will also suggest the next step to be able to retrieve the data.

2. Media recovery

Atola Insight Forensic can recover and/or remove unknown HDD passwords (also known as ATA-passwords). For most hard drives the unlocking process is fully automated. Some hard drives (for example, latest 2.5-inch Hitachi hard drives) require a degree of manual interference. Operator can choose whether to display the password or just remove it and unlock the drive. Both security levels (High or Maximum) are supported.

To get the list of the hard drives currently supported by automatic password recovery routine, see Supported drives.

Manual firmware recovery

If there is firmware damage that cannot be fixed automatically, you will have to proceed with manual firmware recovery procedure. Generally speaking, firmware recovery process includes of the following steps:

1. Full firmware backup

2. Diagnosis

3. Recovery

Backup is a very important part of the process. Make sure you have full firmware backup before you make any change to the firmware area.

Basic diagnostics of the firmware area is done during Automatic Diagnostics process (see Automatic Diagnostics). More in-depth diagnostics is done during firmware backup process, after which any firmware damage that may exist will become obvious, as damaged modules will have either "Read Failure" or "Bad Checksum" mark. Some of these damaged modules can be recovered by right-clicking them and selecting Recover (module will be re-generated and written to the drive). In some rare cases, when Atola Insight Forensic cannot regenerate the module, you would have to copy it from a donor drive (you would need to locate a similar hard drive, save that module from that drive into a file, and then copy that file into the bad drive's firmware, replacing the damaged module).

Please note: if after the full firmware backup you find that there are many unreadable firmware modules (more than 10% of total number of modules), it might be a good indication that the head stack is malfunctioning. The best thing to do in this case is to reconfirm that the hard drive does not have a head damage before proceeding with firmware recovery attempt. Attempting firmware recovery on a hard drive with internal damage may result in an unrecoverable damage.

3. Image creation

Before you proceed with any file recovery attempt, it is very important that you have a sector-by-sector copy of the drive. This is done with the Imaging module available in the software.

For more details, see Imaging.

4. File recovery

After you made a copy of the original hard drive, you can start recovering files. File Recovery engine is able to show status of each file in the file browser, such as what percentage of file was imaged without errors. There's also an ability to create lists of files specifying the status of each file. After creation, the list may be presented for a review.

To learn more, see File Recovery.

Insight Forensic features supported for the M.2 SSD extension

Here are the differences in PCIe NVMe M.2, PCIe AHCI M.2, and SATA M.2 support in Atola Insight Forensic working with the DiskSense 2 hardware unit:

Supported PCIe NVMe M.2 and PCIe AHCI M.2 features:

• Max read/write speed: 700 MB/s
• Write protection
• Imaging
• Diagnostics, media scan
• Damaged drive support
• Hash calculation and verification
• Wiping
• Device utilities:
• disk editor
• media recovery
• SSD trim
• compare (with a pattern, image file or drives)
• and more

Drive hotplug is supported for PCIe NVMe M.2 and SATA M.2 drives, but not for PCIe AHCI M.2 drives.

Plug and unplug the M.2 SSD extension module

DiskSense 2 has a PCI Express port on its back panel, which is labeled as EXTENSION. It is used to connect Atola hardware extension modules supported by Atola Insight Forensic software.

To connect the M.2 SSD extension module to the DiskSense 2 hardware unit, do the following:

1. Power off DiskSense 2.
2. Align the 3 holes on the extension module with the 3 screw holes on the DiskSense 2 back panel. Firmly plug the M.2 SSD extension module all the way into the Extension port and fasten the module with 3 screws.
3. Plug a PCIe NVMe M.2, PCIe AHCI M.2, or SATA M.2 drive into the extension and fasten the drive in place with the black plastic slider.
4. Optional: If you plan to work with SATA M.2 drives, connect the plugged extension to one of the SATA ports on DiskSense using a SATA cable. For details, see Connect and identify a SATA M.2 drive on this page.
5. Power on DiskSense 2.

To disconnect the M.2 SSD extension module or replace it with another extension module, do the following steps:

1. Power off DiskSense 2.
2. Disconnect the SATA cable from the extension module (if you were using the cable).
3. Release the screws, which hold the module, and unplug it from the Extension port.
4. Optional: Plug another extension module into the Extension port and fasten the module with a screw.
5. Power on DiskSense 2.

Distinguish between NVMe M.2/AHCI M.2, and SATA M.2 drives

All solid state drives with M.2 form factor look pretty much the same.

But there are different ways to connect PCIe NVMe M.2 and PCIe AHCI M.2 drives on one hand, and SATA M.2 drives on the other hand to DiskSense 2 using the M.2 SSD extension module.

The easiest way to tell apart NVMe M.2 and PCIe AHCI M.2 drives from SATA M.2 drives – when the extension is connected and DiskSense 2 is powered on – is to look at the LED indicator on the extension module, next to the words "When LED is on, plug SATA source port cable here":

• If the LED is off, the drive connected to the M.2 SSD extension module is either NVMe M.2 or PCIe AHCI M.2. See Connect and identify an NVMe M.2 or AHCI M.2 drive.
• If the LED is on, the drive is SATA M.2. See Connect and identify a SATA M.2 drive.

To define the type of a particular M.2 drive before connecting it to TaskForce, check the markings on the drive or refer to the manufacturer’s specifications.

Connect and identify an NVMe M.2 or PCIe AHCI M.2 drive

1. Power off the M.2 SSD extension using the SSD PWR button on the extension. LED power indicator on the extension turns off.

2. Plug a PCIe NVMe M.2 or a PCIe AHCI M.2 drive into the extension and fasten the drive in place with the black plastic slider.
3. Power the extension on by pressing the SSD PWR button. The LED power indicator on the extension is on.

4. In Atola Insight Forensic, go to Port > Select Source.

5. In the Source device selection window, choose the drive connected to the Extension port, and then click Select.
   Non-SATA sources can only be opened in the SATA Source 1 port. If you have another device attached to the SATA Source 1 port, the system may suggest powering it off.

6. In the Insight interface, click Re-identify to initialize your source drive.

Once the drive is connected and identified, you can proceed to diagnostics, imaging, hashing or other operations.

Work with several NVMe M.2 drives in a row

Drive hotplug is supported for PCIe NVMe M.2 drives, but not for PCIe AHCI M.2 drives. You can plug several NVMe M.2 drives one after another, without turning DiskSense 2 off and on again.

To define the type of a particular drive, check the markings on it or refer to the manufacturer’s specifications.

To replace or remove an NVMe M.2 drive, make sure to power off the M.2 SSD extension module by pressing the SSD PWR button.

Connect and identify a SATA M.2 drive

When you plug a SATA M.2 drive into the M.2 SSD extension module, DiskSense 2 will light up the LED indicator on the module, next to the words "When LED is on, plug SATA source port cable here".

To connect a SATA M.2 drive to DiskSense 2, do the following steps:

1. Using the SATA cable, connect the M.2 SSD extension module to one of the SATA ports on DiskSense 2.
2. In Atola Insight Forensic software, power off SATA Source port.
3. Plug a SATA M.2 drive into the extension and fasten it in place with the black plastic slider.
4. In Atola Insight Forensic, power on SATA Source port.

Work with several SATA M.2 drives in a row

For SATA M.2, drive hotplug is supported. You can connect and replace SATA M.2 drives without turning DiskSense 2 off and on again.

For safety reasons, before replacing SATA M.2 drives, the port must be powered off by clicking the Power button on the source port in the Atola Insight Forensic interface.

To define if a particular M.2 drive is SATA type or not, check the markings on it or refer to the manufacturer’s specifications.

Also, if your drive belongs to SATA type, DiskSense 2 will light up the LED indicator on the extension module, next to the words "When LED is on, plug SATA source port cable here".

Connect a U.2 NVMe drive using adapter

To use a drive with U.2 interface, attach the drive to DiskSense 2 unit with the help of a U.2-to-M.2 adapter and a cable (not included in the package).

To connect a U.2 drive to the unit, do the following:

1. Plug the U.2 drive into the U.2-to-M.2 adapter using the cable.
2. Plug the U.2-to-M.2 adapter into the Atola M.2 SSD extension.
3. Plug the extension into DiskSense 2 while the unit is powered off.

Insight Forensic features supported for Apple PCIe SSD extension

The following Insight operations and features are supported for the Apple drives:

• Imaging at 550 MB/s (33 GB/min)
• Write protection
• Diagnostics, media scan
• Damaged drive support
• Hash calculation and verification
• Wiping
• Device utilities:
• disk editor
• media recovery
• SSD trim
• compare (with a pattern, image file or drives)
• and more

Plug and unplug the Apple PCIe SSD extension module

DiskSense 2 has a PCI Express port on its back panel, which is labeled as EXTENSION. It is used to connect Atola hardware extension modules supported by Atola Insight Forensic software.

To connect the Apple PCIe SSD extension module to DiskSense 2, do the following:

1. Power off DiskSense 2.
2. Align the screw on the extension module and the top screw hole on the DiskSense 2 back panel. Firmly plug the Apple PCIe SSD extension module all the way into the Extension port and fasten the module with a screw.
3. Plug Apple PCIe SSD drive into the extension and fasten the drive in place with the plastic latch.
4. Power on DiskSense 2.

To disconnect the Apple PCIe SSD extension module or replace it with another extension module, do the following steps:

1. Power off DiskSense 2.
2. Release the screw, which holds the module, and unplug it from the Extension port.
3. Optional: Plug another extension module into the Extension port and fasten the module with a screw.
4. Power on DiskSense 2.

Insight Forensic features supported for SAS extension

Atola Insight Forensic supports most operations for a SAS drive plugged into DiskSense 2:

• Write protection
• Current sensing, short circuit and overvoltage protection
• Damaged drive support
• Diagnostics, media scan
• Hash calculation and verification
• Wiping
• Device utilities:
  • disk editor
  • file recovery
  • compare (with a pattern, image file or drives)
  • and more

There are a few functions that are not available for SAS drives:

• Host Protected Area (HPA)
• Device Configuration Overlay (DCO)
• Security features
• SSD Trim
• Firmware recovery

Plug and unplug the SAS extension module

DiskSense 2 has a PCI Express port on its back panel, which is labeled as EXTENSION. It is used to connect Atola hardware extension modules supported by Atola Insight Forensic software.

To connect the SAS extension module to the DiskSense 2 hardware unit, do the following:

1. Power off DiskSense 2.
2. Align 3 holes on the extension module and 3 screw holes on the DiskSense 2 back panel. Firmly plug the SAS extension module all the way into the Extension port and fix the module with 3 screws.
3. Power on DiskSense 2.

To disconnect the SAS extension module or replace it with another extension module, do the following steps:

1. Power off DiskSense 2.
2. Release the screws, which hold the module, and unplug it from the Extension port.
3. Optional: Plug another extension module into the Extension port and fixate the module with a screw.
4. Power on DiskSense 2.

Connect a SAS drive to DiskSense 2 using SAS extension module

1. Plug the mini SAS connector into the extension module.
2. Plug the molex power connector into the SATA 1 source power socket.
3. Plug the SAS connector into the drive.

Hotplug for SAS drives is supported. You can connect and disconnect SAS drives without turning DiskSense 2 off and on again.

Insight Forensic features supported for Thunderbolt extension

Insight supports the following operations and features on MacBooks when connected through the Thunderbolt extension:

• Imaging
• Hash calculation and verification
• Write protection
• Media scan
• Device utilities:
  • file recovery
  • compare (with a pattern, image file or drives)
  • and more

Plug and unplug the Thunderbolt extension module

DiskSense 2 has a PCI Express port on its back panel, which is labeled as EXTENSION. It is used to connect Atola hardware extension modules supported by Atola Insight Forensic software.

To connect the Thunderbolt extension module to the DiskSense 2 hardware unit, do the following:

1. Power off DiskSense 2.
2. Align the screw on the extension module with the top screw hole on the DiskSense 2 back panel. Firmly plug the Thunderbolt extension module all the way into the Extension port and fasten the module with a screw.
3. Power on DiskSense 2.

To disconnect the Thunderbolt extension module or replace it with another extension module, do the following steps:

1. Power off DiskSense.
2. Release the screw, which holds the module, and unplug it from the Extension port.
3. Optional: Plug another extension module into the Extension port and fasten the module with a screw.
4. Power on DiskSense.

Connect MacBook using Thunderbolt extension module

First, write down or take a photo of a serial number located on the bottom side of the MacBook. It will be needed later.

Then do the following steps:

1. Turn off both MacBook and DiskSense 2.
2. Plug the Thunderbolt extension module into the Extension port and fasten the module with a screw.
3. Connect MacBook to the DiskSense 2 unit with the help of Thunderbolt extension and the FireWire cable. Use the adapters (included) to connect to the MacBooks with Thunderbolt 2 or Thunderbolt 3 interface.

4. Boot MacBook in Target Disk Mode. To do that, start it up while holding down the T key. You should see a Firewire or Thunderbolt icon displayed on the screen, indicating that Target Disk Mode is on.
5. Power on the DiskSense 2 hardware unit.
6. Launch Atola Insight Forensic on your computer.
7. In the pop-up window, select Identify device.
8. In the Source – Select MacBook Case window, click Add new case.

Select MacBook Case

9. If it is the first time this MacBook is identified by Insight, in the Enter MacBook serial window, enter the serial number located on the bottom of the MacBook, and then click OK.
   
   When the MacBook is connected to Insight next time, you can simply select the appropriate case from the table.

Opening an existing MacBook case from the Select MacBook Case window.

Step 1. Download and install Atola Insight Forensic software

Atola Insight Forensic software requires a PC with Windows 10/11 (64-bit). Check minimum and optimal hardware requirements before installing the software.

1. Go to the Atola Insight Forensic Downloads page and download the latest version of the full installation package.
2. Run the installer and proceed with setup steps.
   If Windows warns you about an unrecognized app, click Run anyway and allow the app to make changes to your device.
3. Optional: If you don’t have Microsoft .NET and Microsoft SQL Server on your computer, the installer prompts to install these components.
4. After the installation is finished, reboot your computer. Don’t launch Atola Insight Forensic software yet.

Step 2. Configure your network

DiskSense 2 can be configured to use either a static or dynamic IP address.

• Direct connection: If you plan to connect the DiskSense 2 hardware unit directly to your computer, we recommend using the static IP address.
• Using router: If you plan to connect the DiskSense 2 hardware unit through a network router or switch, we recommend using the dynamic IP address.

If your computer has no Ethernet port, you can use the USB-to-Ethernet adapter included in the package. Connect it to your computer before configuring a network.

Use a static IP address

1. In Windows, open Network Connections: press Win+R, enter ncpa.cpl and click OK.
2. Right-click your Ethernet adapter, and then select Properties.
3. Select Internet Protocol Version 4, and then click Properties.
4. Enter the following network settings:
   • IP address: 10.0.0.XXX, where XXX can be any number from 1 to 254 except for 188.
     Default IP addresses of the DiskSense 2 unit are 10.0.0.188 and 192.168.0.188. The IP address of your PC's Ethernet card must be different from that of the DiskSense 2 unit.
   • Network mask: 255.0.0.0.
     If your PC and the DiskSense 2 unit belong to different subnets, the connection can’t be established.
   • Gateway and DNS server can be left empty or set to any value.
5. Click OK.

To use a static IP address, on Step 3 connect a network cable to the ETH 1 port of DiskSense 2.

Use a dynamic IP address

The ETH2 port of DiskSense 2 is set to automatically receive an IP address from your network router (DHCP server).

If you want the unit to use a dynamic IP address, on Step 3 connect a network cable to the ETH 2 port of DiskSense 2.

Step 3. Connect DiskSense 2

1. Before setting up and connecting DiskSense 2, write down or take a photo of the Device serial number. It is located on the bottom of the DiskSense 2 unit. You will need the Device serial number on Step 5 to activate the Atola Insight Forensic software.
2. Plug the power supply cable to the DC IN socket on the back of the DiskSense 2 hardware unit.
3. Connect an Ethernet cable to DiskSense 2:
   • If you plan to use a static IP address, choose the ETH1 port.
   • If you plan to use a dynamic IP address, choose the ETH2 port.
4. Connect the other end of the Ethernet cable to your PC or router.

Step 4. Power on DiskSense 2

1. Make sure that there are no USB devices attached to the DiskSense 2 hardware unit.
2. Using the PWR switch on the back panel of DiskSense 2, power on the unit.
3. Wait for the PWR LED on the back of the unit to stop blinking.
4. When booting is finished, the unit's IP address appears on the IP screen on its front panel.

Step 5. Launch and activate Atola Insight Forensic software

To activate Atola Insight Forensic software, you need the Device serial number of the DiskSense 2 hardware unit. It is located on the bottom of the DiskSense 2 unit.

1. Launch Atola Insight Forensic.
2. To prevent blocking communication between the software and DiskSense 2 hardware unit, in your firewall and anti-malware, allow access for insight.exe.

There are three options to activate Atola Insight Forensic:

1. Online activation. Choose this option if your computer has an internet connection.
2. Offline activation. Choose this option if your computer does not have an internet connection, but you can use a USB drive.
3. Offline activation by code. Choose this option if your computer does not have an internet connection and you cannot use USB or any other removable drive.

Online activation

To activate Atola Insight Forensic online, you need to have an internet connection on your computer.

1. In the Activation dialog, choose Online activation and click Continue.
2. Fill out all fields in the Activation form and click Continue.
3. Atola Insight Forensic confirms that activation has been successfully completed. Click Finish.

Offline activation

To activate Atola Insight Forensic offline, you need another PC with internet connection and a flash memory stick.

1. In the Activation dialog, choose Offline activation and click Continue.
2. Fill out all fields in the Activation form and click Continue.
3. Save the Activation****.aa file to a USBstick.
4. Using another computer connected to the internet, go to activation.atola.com.
5. Click Choose File to upload the Activation****.aa file from the USB stick, enter your email and click Submit.
6. Atola sends you an email with an Activation response file: Response****.ar. Save this file to your USB stick.
7. In the Insight Activation dialog, submit the Response****.ar file from the USB stick and click Continue.
8. Atola Insight Forensic confirms that activation has been successfully completed. Click Finish.

Offline activation by code

To activate Atola Insight Forensic offline by code, you need another device with internet connection (PC or mobile).

1. In the Activation dialog, choose Offline activation by code and click Continue.
2. Enter Device serial number located on the bottom of the DiskSense 2 unit and click Continue.
3. Save the following information from the Insight Activation dialog:
   • Hasp ID
   • Insight version
   • Checksum
4. Using another device connected to the internet, go to the Atola licensing webpage: activation.atola.com/ActivateByCode.
5. Fill out all the fields on the Atola licensing webpage, including:
   • Device serial number (from the bottom of the unit).
   • Hasp ID, Insight version, Checksum (from the Insight Activation dialog).
   • Your email, phone number, and organization.
6. Click Submit. Atola licensing webpage generates an Activation code and also sends it to the email address you provided.
7. On your computer, go back to the Insight Activation dialog, enter your Activation code and click Continue.
8. Atola Insight Forensic confirms that activation has been successfully completed. Click Finish.

Run Atola Insight Forensic on several computers

Activation details are stored in the DiskSense 2 unit itself. If you decide to install the Atola Insight Forensic software on another computer, there’s no need to reactivate it.

It is permitted to install multiple copies of the software on many computers and use a centralized database for convenience. See Network database setup.

Change or reset an IP address of DiskSense 2

Change an IP address

To change the IP address of the DiskSense 2 unit, choose one of the following:

• Run Atola Insight Forensic and go to Insight > Modify DiskSense Unit IP
  Or,
• Use DS Unit Update Tool, by running the DSEthernetUpdate.exe file located in your Atola Insight Forensic folder.

Reset an IP address

1. Power on the DiskSense 2 hardware unit.
2. While the unit is booting, press and hold the small IP RESET button on its back side.
3. Still holding the IP RESET button, wait until the PWR LED stops blinking.

Now the unit has default IP addresses: 10.0.0.188 and 192.168.0.188.

The reset procedure does not affect the ETH2 port, because its IP address is auto-assigned by your network router (DHCP server).

10Gb network connection

For saving time when imaging to a network folder, we recommend using a 10Gb Ethernet network.

Buy subscription

There are two ways to purchase an Atola Insight Forensic subscription:

• From a sales representative: the Atola sales rep or the reseller that sold you the unit. For contact information, see Where to buy.
• Online on the Subscriptions page on the Atola website. After the purchase, we send a subscription key to your email.

After you have purchased the subscription for another period, you need to reactivate it.

Reactivate subscription

You can reactivate the subscription even if your computer does not have an internet connection. There are different options to reactivate a subscription offline, depending on how you buy it.

If you buy a subscription from a reseller or the Atola sales department:

• Buy from a sales representative, activate offline by code.
• Buy from a sales representative, activate offline with a USB flash drive.

If you buy a subscription online on the Atola website:

• Buy online, activate offline by code.
• Buy online, activate offline with a USB flash drive.

When Insight software update is not covered by subscription

If your subscription expired but you installed a version of Insight software that is not covered by your expired subscription, you can do one of the following:

• Return to an earlier version of the software and go through the steps outlined earlier in this article to activate the new subscription and update the software to the new version afterward.
• When you launch Insight software you will get the screen below and choose the third or the fourth options, which will then take you through the steps outlined above in this article.

Begin with source drive selection

The Source Device Selection dialog is available from the menu bar (Source > Select Source) or via F3 shortcut key:

Source device selection

At this point you can select the port you'd like to work with (SATA, USB, IDE Master, IDE Slave).

After you select the device, Atola Insight Forensic switches to the main application window.

Attaching and detaching drives

You can attach and remove drives at any time without restarting the software or hardware unit.

When replacing drives, Atola Insight Forensic detects the change automatically. However, if you'd like to manually re-identify a hard drive, you can do one of the following:

• Use the Source Port Re-Identify button or press F2.
• Use Source > Select Source menu item.

Source device menu

The difference is that re-identification works only when the attached drive can return at least some identification data. When the hard drive has significant damage (for example, a burnt PCB) and therefore won't return identification data, Atola Insight Forensic will fail to automatically recognize such hard drive.

In this case you would have to use Source > Select Source menu item to manually select the device. Atola Insight Forensic will still be able to diagnose a hard drive that is "completely dead" by relying on the current sampling.

Before disconnecting hard drives from the unit, we recommend to use the Power Off button in Atola Insight Forensic software to properly shut down the drive:

Source power button

Working with IDE drives

The only way to connect an IDE drive to DiskSense 2 unit is Atola External IDE adapter, which is included in the product package.

The adapter plugs straight into the IDE (USB-C) port located on the front side of the DiskSense unit.

3.5-inch IDE drive connection

2.5-inch IDE drive connection

1. Menu bar

The Menu bar contains Insight Forensic commands grouped in six menus:

• Insight
• Port
• Cases
• Windows
• Multi-launch
• Help

Insight menu

• Change DiskSense Unit: Lets you switch between the different DiskSense hardware units connected to your local network or PC.
• Modify DiscSense Unit IP: Configures a network address and hostname of the DiskSense hardware unit.
• DiskSense Information: Shows unit's serial number, firmware version, IP and MAC address, as well as network speed. Keyboard shortcut: Ctrl+D.
• Manage SSH Root Password: Lets you remotely access the device's operating system for additional maintenance.
• Preferences: Configures system settings, such as work folder path, system language, case management and file recovery settings etc. Keyboard shortcut: Ctrl+Q.
• Database Connection Settings: Sets up server path and database name, authentication method and credentials, as well as the path for backups.

Port menu

• Select Source: Allows choosing another source device (SATA/IDE/USB). For details, see Working with SATA, USB, IDE drives. Keyboard shortcut: F3.
• Reset: Resets a hard drive's interface. Keyboard shortcut: Shift+F2.
• Re-Identify: Should be used after you replace the drive. Keyboard shortcut: F2.
• Spindown: Sends the ‘Spindown Immediate’ ATA command to the drive.
• Detect All Devices: Sends identification commands to all devices connected to the DiskSense 2 hardware unit and displays all detected devices on the Device panel. Keyboard shortcut: F6.
• Assign Case Number: Allows assigning a specific number to the open case. Keyboard shortcut: Ctrl+N.
• Print: Prints or saves to a file the whole case history. For details, see Printing reports in a case. Keyboard shortcut: Ctrl+P.
• Export Current Case: Saves the entire case history into a single file. Keyboard shortcut: Ctrl+E.
• Show History Folder in Explorer: Opens the file folder of the current case in Windows Explorer.

Cases menu

• Search/Open: Lets you find a case according to specific criteria and open it. For details, see Finding and opening a case. Keyboard shortcut: Ctrl+O.
• Export: Brings the window with all available cases, in which you can select cases and export them to a defined folder. For guidance, see Exporting and importing cases.
• Import: Imports a case from another computer into the Insight Forensic database. For guidance, see Exporting and importing cases. Keyboard shortcut: Ctrl+I.

Windows menu

• Current Oscilloscope: Helps to keep track of hard drive power consumption levels and can be especially useful for damaged hard drive diagnostics. Keyboard shortcut: Ctrl+U.
• Terminal: Helps in accessing the firmware area of certain hard drive models for manual firmware recovery. Keyboard shortcut: Ctrl+K.

Multi-launch menu

This menu lets you quickly launch the following operations on multiple devices at once:

• Automatic Checkup (drive diagnostics)
• Fill or Erase
• SSD Trim
• Artifact Finder
• Calculate Hash
• Locate Sectors

Help menu

• Manual: Opens a single-page user manual for Insight Forensic in your web browser. Keyboard shortcut: F1.
• Keyboard Shortcuts: Opens a PDF file with a list of all keyboard shortcuts used in Insight Forensic.
• Send Feedback: Redirects to a contact form on the Atola Technology website.
• Extend Subscription: Provides variants of extending your software subscription for another period, either offline or online.
• Activation Status: Shows information about your current subscription: subscription ID, activation status, subscription due date.
• About: Provides information about your current Insight Forensic firmware version and the serial number of your DiskSense 2 hardware unit.

2. Case panel

This panel shows the current case number. To add or change the case number and description, click the small plus icon.

3. Source port controls and indicators

The source port consists of several parts:

• Power button: Allows to manually apply power to the hard drive attached to the DiskSense 2 unit.
  • When power is on, a single button click sends a spin-down command first and then performs power-off.
  • When power is on, you can click the button a second time during spin-down to instantly power the device off.
• Re-Identify button: Used when you replace the hard drive.
• HDD model, firmware, and serial number: Hard drive identification info.
• Device interface type: Can be SATA, USB, or IDE.
• DCO tag: Indicates whether Device Configuration Overlay (DCO) is activated.
• HPA tag: Indicates whether the Host Protection Area (HPA) is activated.
• PWD tag: Indicates if the hard drive is locked with an ATA password.

Source port context (right-click) menu

• Select Source: Allows choosing another source device (SATA/IDE/USB). For more information, see Working with SATA, USB, IDE drives.
• Select source file: Allows choosing a raw image file located on a source device.
• Reset: Resets a hard drive's interface.
• Re-identify: Should be used after you replace the drive.
• Spindown: Sends ‘Spindown Immediate’ ATA command to the drive.
• Current Oscilloscope: Brings up the oscilloscope window.
• Terminal: Brings up RS-232/serial terminal window.
• Assign Case Number: Allows assigning a specific number to the open case.
• Print: Prints or saves the whole case history to a file. For details, see Printing reports in a case.
• Export: Saves the entire case history into a single file.
• Import: Imports case history from a previously exported file.

4. Target port controls and indicators

The Target port has all the features of the Source port. The Target port allows to work with one of the following:

• A device attached to the hardware target port (SATA or USB).
• Image file: Raw, E01, AFF4.

Target port context (right-click) menu

Along with the commands that are identical to the ones in the Source port context menu, the Target port context menu has an additional one:

• Remove port: Powers down the selected port and removes it from the Device panel.

5. Plus icon

To start another operation, add another target drive port for:

• SATA device
• USB device
• Image file
• Image file on target
• Multiple devices of any type

Detect All Devices: Sends identification commands to all devices connected to the DiskSense 2 hardware unit and displays all detected devices on the Device panel.

6. Sidebar

This sidebar helps to navigate through operations and different software modules of Insight Forensic.

7. Selected device information

Shows detailed information about the device currently attached to the selected port:

• Model number
• Serial number
• Firmware version
• Security status
• Number of LBA sectors
• Device capacity
• LBA48 mode support
• Physical and logical sector size

The View ID Sector link will open the full information on the ID sector returned by the hard drive.

8. Case history

Lists all actions that were done to the selected device. To get a detailed report on an action, click on its name.

9. Attached files

Insight Forensic lets you attach files to the case. Whenever you attach a picture, a thumbnail is added to the Home screen.

To attach an image or file to the current case, click the green plus icon. For details, see Add a document or an image to the case.

10. ATA Registers bar

Displays raw contents of Link, Status, and Error ATA registers in real time. To learn more about each register, see ATA registers: what they mean.

Good hard drive

Drive without bad sectors

There are two graphs; the top graph represents single block read time (one block is 2048 sectors which equals to 1 megabyte), and the bottom graph represents read speed for the entire surface.

Now let's have a look at some graphs taken from damaged hard drives.

Unstable hard drive

We call such hard drives "unstable". They usually do not have read errors, but at the same time media access times are very high and change sporadically. In most cases it is possible to create a clean image of such drive.

Hard drive with damaged head

You can observe patterns of delays which indicate head damage. However, please note that although the head is damaged, it can still read some sectors without errors, therefore it is possible to create a relatively good image of such hard drive by imaging data off good heads first, and then off the bad head.

Read errors

Read errors are displayed as vertical red bars. Please note that when scanning, Atola Insight Forensic shows the entire block as bad even when only one sector in that block is damaged.

View SMART table

To view SMART table of a drive:

1. In the sidebar, go to Diagnostics > View SMART.
2. Click Read SMART.

Hitachi drive with 1221 pending sectors

SMART table attributes may differ depending on the drive manufacturer. The most critical attributes are:

• Reallocated sectors count
• Current pending sector count
• Uncorrectable sector count

When RAW value of any of these attributes is greater than zero, Insight highlights it in yellow.

The worse the values, especially in these critical attributes, the more carefully the drive needs to be treated.

Compare SMART tables

To keep track of the changes occurring to the attributes of the SMART table, Insight records SMART table indices prior and after each imaging session.

To open both SMART tables for side-by-side comparison:

1. After the imaging is completed, check the Imaging Results.
2. In SMART data line, click the View link.

By comparing the two tables, operator can evaluate whether the health of a drive has been deteriorating throughout the imaging session and thus assess how quickly its health has been getting worse.

How SMART table state changed after image acquisition

Whenever you need to evaluate how the state of the drive has been changing long-term, you can go to previous imaging sessions and look up SMART table. Insight stores this information in its case management system.

Create an encrypted target volume

After your source drive is identified by the system perform these steps:

1. In the sidebar, go to Imaging.
2. Click Create New Session.
3. In the Target Device Selection dialog, select target device and then click Create Image File on Target link.


4. In the Create file dialog, select Create an encrypted VeraCrypt container (exFAT) and click Next.


5. To complete the creation of a VeraCrypt volume, enter the password and click Next.
   

6. To confirm formatting the drive to create the encrypted partition, enter YES and then click Format.


Formatting takes a few seconds.



7. Enter a name for a new image file, click Add and then click Select.


8. Specify the settings for this imaging session and click the Start Imaging button.


After you click the Start Imaging button, Insight begins imaging data into the file on your encrypted target.

Upon completion of the imaging session, check the Imaging results screen.

Extract data from your encrypted VeraCrypt volume

1. To find the VeraCrypt volume and the imaged file, plug the target drive into your computer.
2. Use VeraCrypt software to safely access encrypted data from your drive.
3. Select the drive label (A, B, C, etc.) on which you want the volume to be mounted.
4. Click the Select device button.
5. In the pop-up window, select your encrypted volume.
6. Click the Mount button. Now you can view the partition name, size and encryption algorithm.
7. To get access to the encrypted volume, use the password set prior to the imaging session.




8. Once you have entered the password, the volume will be mounted and you can access it from Windows Explorer and use the image for subsequent operations.

Select a new E01 file

1. In the sidebar, click Imaging.
2. Click Create New Session.
3. In the Target Device Selection dialog, click the Create Image File link.


4. In the Image File Selection dialog, select E01 file extension in the drop-down menu to create an image file with this extension and enter the name you prefer in the File Name field.


5. In the Image File Options dialog, fill out all the relevant fields. You can also do it later on the Home page of the file when it is created.


6. In the Target Device Selection window, click the Select button.
7. Insight creates an E01 file with current 0 bytes capacity. Its final capacity will be defined by the amount of imaged data it contains plus the metadata.

Calculate the hashes during imaging

1. In the sidebar, click Imaging.
2. Click Create New Session.
3. In Preset line, click the Show settings link.
4. On the Passes and Hash tab, select the Hash source during imaging option.
5. In the Hash method list, select Linear.
6. In the Hash type list, select MD5 and SHA-1.
7. Click Start imaging.


8. Upon completion of imaging, on the Imaging Results page, Insight features both MD5 and SHA-1 hashes.


Calculated MD5 and SHA1 hashes

Artifacts settings

1. On the sidebar, click Imaging.
2. Click Create New Session.
3. In the Target Device Selection dialog, select target device.
4. Open the Artifacts tab.

In this tab it is possible to view, select or deselect the artifacts you want to be searched in the course of imaging.

For each of these artifacts we have not only applied well-known algorithms including the Luhn formula used to validate credit card numbers, but also applied our own smart filters to eliminate false results (for example, if there are two slashes near the number that has preliminarily been identified as a credit card number, that will eliminate it from the search results, as it is likely to be a part of a URL).

Keywords and regular expressions can be added to the search parameters in a txt file with one artifact per line. Next to the Keywords category on the Artifacts tab, click the View link before imaging and make sure the keywords are displayed correctly. Keyword encoding can be adjusted to Unicode, Unicode (UTF-8), Unicode (Big-Endian) or US-ASCII.

A few of the artifacts are selected by default, namely: GPS, MAC, Phone numbers, URL. You can adjust these default settings and click the Save settings button. This will affect all future imaging sessions (including those on new source drives) unless you re-adjust the settings or restore the default settings by clicking the corresponding link. The paths to the files with keywords and regular expressions will also remain saved, although should any changes by made to the txt files in the saved directory, the changes will be uploaded at the start of each imaging session.

Once you have ticked the boxes next to the artifacts you would like to be searched for, click the Start Imaging button.

Browse through the artifacts in the course of imaging

Once imaging has begun, go to the Artifacts tab in the bottom part of Insight window and watch the selected artifacts being found: the numbers of artifacts and the corresponding diagram change on the go.

To see the artifacts in a list, press on any of the categories or the diagram.

In the table, each artifact is assigned an Id number, each found Value is shown in the context (including 20 bytes before and 20 bytes after the artifact in grey color), the LBA and the Offset are also displayed in the table to help locate the artifact.

There are many options to help find, sort, filter and view the artifacts: it is possible to view one or a few categories of artifacts in one list, use the Search bar to find a specific value (search examples are provided in the bottom right corner of the window), filter results for unique values by clicking the Show unique artifacts link.

The latter option is quite valuable as it helps identify the values most frequently occurring on the drive: to sort the results click Count in the table header.

To promptly find the sector where an artifact is located, you can double click the artifact you would like to examine more thoroughly.

Export artifacts

The Export to CSV button is disabled during imaging. You can wait until imaging is completed or pause it, make an export and restart imaging, should it be necessary to start analyzing the current artifact search output with an external tool:

1. Pause imaging.
2. On the Imaging results screen, click the Artifacts link.
3. On the Artifacts screen, select the artifacts you would like to be exported (for example, one or multiple artifact categories, unique artifacts or only those fitting certain search criteria).
4. Click the Export to CSV file button.
5. Select the path for the file and click Export.
6. Once the export is completed (which normally takes no longer than a few seconds), restart imaging.

Now, in the Imaging category on the Sidebar, there is the Export artifact link. If the source drive was imaged in multiple sessions, and artifact lists were created during different imaging sessions, by clicking this link you can download a merged list of artifacts from multiple imaging sessions.

Split an interrupted multi-target imaging session

1. Connect the source device to the DiskSense unit.
2. In the sidebar, click Imaging and find the interrupted imaging session to several targets. If not all target drives and image files are available, it is impossible to simply resume imaging.
3. To split the interrupted imaging session into separate ones, one per each target, click the Split all sessions to separate targets link. Insight splits the session.

4. To resume imaging to each separate target, click Resume in each target’s Imaging Session.

5. The resumed imaging session skips all the sectors imaged to the target during the previous session.

This way you can complete the imaging to all targets at different times, as they become available.

All sectors

By default, Insight Forensic is set to image all sectors of a drive. With this option selected in the What to image list on the imaging setting screen, the system will create a full physical copy of a source drive.

The All sectors option selected in the What to image list.

All sectors with data

To image the whole system structure of the drive including folders and files, while omitting the areas with no data or fragments of previously deleted files, do the following:

1. Go to Imaging > Create New Session.
2. In the What to image list, select All sectors with data.


The All sectors with data option selected in the What to image list.

3. Recommended: Enable segmented hashing for an imaging session:
   1. In the Preset section, click the Show settings link.
   2. On the Passes and Hash tab, enable Hash source during imaging.
   3. Set the Hash method to Segmented.
   Otherwise, if you use the linear hashing method, the hash values of the source and the target drives, as a result of imaging only sectors with data, will not be identical.


Enabling segmented hashing in the imaging settings.

4. Adjust other imaging settings as needed and click Start imaging.
5. When you choose to image all sectors with data, the imaging log adds a message about the partitions Insight has been able to find. A link to the file with segmented hashes is included in the Imaging Results report.


The Imaging Results report with messages about partitions found during imaging all sectors with data.

All sectors with metadata

To image only the system structure of a drive without data within its files (for example, MFT in NTFS), do the following:

1. Go to Imaging > Create New Session.
2. In the What to image list, select All sectors with metadata.
3. Adjust other imaging settings as needed and click Start imaging.

Imaged metadata can be used later to browse through files and select the ones to be imaged in full. For more details, watch this video guide: Benefits of imaging metadata.

When choosing to image all sectors with metadata, the imaging log adds a message about the partitions that Insight has been able to find.

The All sectors with metadata option selected in the What to image list.

Sector list from file

If you have a text or a CSV file with a list of sectors you want to image, you can select the relevant option in the imaging settings, and Insight Forensic will image only the sectors specified in the file you provided:

1. Go to Imaging > Create New Session.
2. In the What to image list, select Sector list from file.
3. Click the Select file link and choose a file with a list of sectors.
4. Adjust other imaging settings as needed and click Start imaging.


Selecting a file with a sector list to image in the imaging settings.

Custom sector selection

In Insight Forensic, you can fine-tune sector ranges you want to image, specifying start and end LBA, including or excluding certain partitions or sector ranges, or customizing imaging ranges for each partition. Here’s how to do it:

1. Go to Imaging > Create New Session.
2. In the What to image list, select Custom.
3. Optional: To adjust Start and End LBA, enter values in the respective fields or use sliders.
4. Click the Create or load media map link.


The Create or load media map link on the imaging settings screen.

5. The Media Map Manager window opens. Here are various options to customize the sector ranges for imaging:
   • In the Partition section, you can select partitions to be imaged. Also, you can add a filter for each partition to specify which sectors to image:
     • occupied sectors,
     • only metadata sectors, or
     • sectors without any data.
   • In the LBA ranges section, you can add custom sector ranges you want to image, as well as exclude certain sector ranges from imaging. Click the Add range link, choose the Include or Exclude option from a list and enter the start and end LBA for a range.
   • As you adjust sector range settings, the Summary section immediately updates information about the number of sectors scheduled for copying and their total size.


Adjusting sector ranges for imaging in the Media Map Manager window.

6. After adjusting sector ranges, click OK.
7. Back on the Start new imaging session screen, adjust other imaging settings as needed and click Start imaging.

Analyze data from the imaged sector ranges

Once imaging of the selected sector ranges is complete, you can view the structure of the resulting image you have obtained:

1. On the Imaging results screen, click Analyze target image.

2. The Target port opens. Click the Scan partitions button.
3. Select any of the imaged partitions you want to preview and click the Open partition button.

4. Browse through the imaged folders and files.

Automatically create iSCSI targets

To expose a physical or logical drive via iSCSI on a network, first, you need to set up an iSCSI target correctly. To help you with that, Atola engineers created a Python script named iscsi-targets, that automatically creates iSCSI targets for all drives except for a boot device.

Download iscsi-targets from GitHub →

How to use the ‘iscsi-targets’ script

Here are some examples of using the ‘iscsi-targets’ script.

1. Create iSCSI targets for all drives except for a boot device:
   `sudo python3 iscsi-targets.py`
2. Create a single iSCSI target for the specified /dev/sdb1 partition:
   `sudo python3 iscsi-targets.py /dev/sdb1`

The example below shows the first run of iscsi-targets.py on Paladin. It has added 3 iSCSI targets for SATA and USB drives.

Automated iSCSI target creation in Paladin.

Image up to 3 remote drives in parallel using iSCSI

Here’s how to image a remote drive in Insight Forensic using the iSCSI protocol:

1. Expose a physical or logical drive via iSCSI on a network.
2. Go to Port > Select Source and then click the Add iSCSI device link.
   
   
   
   Alternatively, click the Plus icon at the top and in the Add Source menu select iSCSI Device.
   
3. Enter the IP address and Port of a remote storage device. If needed, also enter a user name and password for remote authentication.
   
4. Click Discover.
5. Insight Forensic searches and shows all the iSCSI devices available at the IP and port address you provided. Select your device.
   
6. Create a new case for an iSCSI device or select an existing one.
   
7. Insight Forensic opens the selected iSCSI device as a separate port.
   

Now, you can image this device as usual or launch other operations, such as:

• File recovery
• Artifact finder
• Locate sectors
• Caclulate hash
• Disk editor (in read-only mode)

Diagnose first

Whenever you start working on a drive, the very first thing we recommend to do is to find out if the drive is damaged in any way, and if so, what is the extent of the damage.

Insight Forensic comes with a fully automated diagnostics module. It diagnoses all drive components and data on it:

• printed circuit board (PCB),
• spindle motor,
• head stack,
• firmware,
• and file systems.

Diagnostics works properly even if the drive has burnt parts or damaged head stack—the routine makes use of the current monitor that is embedded into the DiskSense unit.

After diagnostics, Insight Forensic generates a detailed report, which lists the exact issue with the drive and suggests the best approach for data acquisition.

A diagnostics report of a damaged drive.

Default settings for imaging damaged drives

Most imagers have a linear imaging process. Whenever such an imager encounters a bad sector on a drive, the process slows down drastically. This often causes the drive to freeze.

Insight Forensic operates using a special multipass imaging algorithm that applies a non-linear approach and allows speeding up the imaging of damaged drives while maximizing the amount of successfully retrieved data.

The default settings of the passes are based on our decades-long experience in the data recovery market to fit the majority of problematic drives. Therefore, it is advisable to follow them, unless a particular drive requires specific settings.

Default imaging settings for damaged drives with 5 passes.

Let’s clarify the terms used on the imaging settings screen:

• Pass is a single complete cycle of reading blocks from a source device and writing them to a target device, beginning from a start sector and finishing at an end sector (as specified in the What to image field).
• Timeout is the maximum time for a single read block attempt during this pass.
• Jump on errors (sectors) is the number of consecutive sectors that Insight Forensic will skip if it can’t read a block from a source device.
• Max read block size (sectors) is the maximum number of sectors that Insight Forensic reads from a source device at a time.
• Reverse direction: when enabled for a particular pass, the imaging engine reads a source drive backward and reaches the damaged areas from the opposite direction. This way, the imaging module can retrieve more data from a drive before entering a damaged zone, which needs to be concentrated on during the following passes. However, the speed decreases due to the automatic disabling of the drive's cache.
• Disable read look-ahead turns off a read look-ahead functionality, which makes the drive read more blocks sequentially than requested by the software. In good drives, this functionality helps the drive operate faster by reading more data and caching it. With bad drives, the read look-ahead feature leads to bad areas being addressed more often. This slows down the process and may lead to a complete freeze of the drive. In such cases, we recommend disabling the read look-ahead option.
• Use PIO mode enables reading sectors using PIO commands (READ SECTORS EXT, READ SECTORS) instead of DMA commands. This can help in extremely rare cases of damaged drives.

Multipass algorithm for imaging damaged drives

To ensure thorough data extraction and avoid causing further damage to media, Insight Forensic applies the multipass imaging algorithm with deliberate timeout and block size control. Here’s how the algorithm works.

First pass

On the first pass, Insight has a 1-second Timeout per block, and the Max read block size is set to 4096 sectors. The default settings of the first pass allow smooth sequential imaging of all modern drives in good condition.

But when you need to image a drive with bad sectors, these settings make Insight skip any areas that slow down the reading: it performs Jump on error by 1,000,000 sectors at a time.

These settings ensure imaging data from the healthy areas of the drive at top speed while making Insight return to the problematic areas during the following passes. Atola Insight Forensic splits such areas into smaller pieces and allows more time for reading the data within them.

Insight performs Jump on error by 1,000,000 sectors on the first pass.

Second and third passes

While the Max read block size remains the same during the second and the third passes, the Jump on error is set to 20,000 sectors and 4,096 sectors respectively. Insight allows slightly longer, 5-second Timeouts for attempted reading of the blocks. As the jumps become smaller, empty areas start filling up with data.

The secong imaging pass.

Fourth pass

On the fourth pass, to try reading problematic zones in a more granular way, both Jump on error and Max read block size are yet again reduced, this time to 256 sectors.

The fourth imaging pass.

Fifth pass

On the fifth pass, Insight allocates 60-second Timeouts to read the Maximum block size of 256 with just 1-sector Jump on error. It is the last and the most scrupulous attempt to read the remaining problematic areas of the drive.

The fifth imaging pass.

After the final pass, the Imaging Results report will show the eventual number of errors on the drive and other detailed statistics.

The Imaging results report.

Customize imaging settings for each pass

If a particular drive has some unusual damage and requires a specific imaging approach, you can customize the following settings for each pass:

• Timeout
• Jump on error
• Max read block address
• Start and end LBA
• Image in reverse direction
• Disable read look-ahead
• Use PIO mode

On top of that, you can add passes with customized imaging parameters or remove passes.

To change settings for a certain imaging pass, add or remove passes:

1. In the Insight sidebar, click Imaging, and then Create New Session.
2. On the Start new imaging session screen, in the Preset section, click the Show settings link.

3. To adjust a particular parameter, click on a respective field and enter a new value.

4. Optional: Adding or removing passes. After you expand the Imaging settings section:
1. To add another pass, click the Add pass button.
2. To remove a pass, click the X icon next to the respective pass.

5. Click Save settings.

Diagnose first

The built-in Automatic Checkup module of Atola Insight Forensic automatically checks all major subsystems of the evidence drive: circuit board, heads, media surface, firmware and file system.

To run diagnostics, in the sidebar, go to Diagnostics > Automatic Checkup and click Start.

A diagnostics report provides detailed information about the heads. In addition, it offers recommendations for the optimal imaging strategy for your damaged hard drive.

If an Automatic Checkup report indicates that there is a problem with the heads, look at the status of each head.

Head problem found during Diagnostics.

If the status of a head or multiple heads is Degraded or Damaged, the drive will not be able to read all the data. What’s worse, even more sectors may soon become unavailable due to incorrect functioning of the drive’s hardware.

Image good heads

We recommend that you start by imaging the heads, whose status is OK, as soon as possible. To do that:

1. In the sidebar, go to Imaging and click the Create New Session link.
2. Choose the target device or file and click Select.
3. On the Start new imaging session screen, find the Heads section and unselect the damaged head.
4. Click Start Imaging.

Unselect degraded head.

As a result, you get as much data from the drive’s viable heads as possible before even beginning to work with the damaged head. This way the risk of losing data on the working part of the head stack is minimized.

Imaging result with 3 good heads.

Now that this data has been successfully retrieved, you have two options:

• To have the head stack replaced before imaging the remaining data. However, there is a risk that as a result of head stack replacement, data on the drive can become unreadable.
• To attempt imaging data from the Degraded or Damaged head.

Image damaged or degraded heads

Insight’s sophisticated functionality lets users retrieve maximum data even from severely damaged drives. To image damaged or degraded heads, do the following:

1. In the sidebar, go to Imaging and click the Create New Session link.
2. Choose the target device or file and click Select.
3. On the Start new imaging session screen, go to the Heads line, unselect all the working heads and leave only the Degraded/Damaged one(s).
4. Click Start Imaging.

Unselect 3 working heads.

Imaging degraded head.

Now that you have an image of the source evidence including the data copied from the damaged head, you can take the risk and get the head stack fixed. Afterward, you can start a new session to complete the initially created image with data from previously unreadable sectors.

Why do damaged drives freeze?

When a drive receives and runs a Read sectors command, and comes across a physically or logically damaged sector, the device is unable to read any data from that sector. So it goes into Retry mode, trying to get data from the damaged area again and again.

However, often the drive is unable to read data from the damaged sectors, and the Retry mode can last for a very long time before the drive decides to give up on a particular sector and return an error with a timeout.

How does Insight handle freezing drives?

If Insight simply waited for each Read sectors command to be completed:

• it would take ages to get an image of a drive with numerous errors;
• it could cause the drive to slip into complete freeze;
• in the worst-case scenario, further damage could be caused to the data on the drive.

The Reset command

To avoid causing further damage to the data on the drive and long waiting periods, Insight issues the Reset command whenever a drive attempts to read a block of sectors for longer than allowed by the pre-configured timeout.

Reset is a device interface operation, using which Insight (the host) stops the previously sent Read sectors (or any other) command and then continues imaging from the next planned block on the drive.

If the device is still running the Read Sectors command, even after the first Reset attempt, Insight will wait 3 seconds and perform the second Reset command. At the moment of the second Reset, a new entry will appear in the imaging Log reading

Device hangs while reading block X – Y.

Power cycle due to the source device falling into freeze.

How drives become shorted

Most drives have two TVS diodes: one on the 5V rail and another one on the 12V rail.

If a drive experiences an overvoltage, its diodes convert the excess electrical power into heat energy and warm up, thus protecting the drive's circuit. Similarly, in the case of reverse polarity, the diode warms up as it conducts the current in the opposite direction.

If the overvoltage or reverse polarity event is short and the dissipated energy is not too high, the diodes can recover and continue working. However, if the dissipated energy is too high, the diodes will "sacrifice" themselves and get shorted.

When the drive is subsequently powered, the shorted diodes create a low-resistance connection between two nodes, known as a short circuit. This is exactly what happens to a drive when its TVS diodes are shorted.

Detect a shorted drive

If you try to connect a shorted drive to Atola Insight Forensic, the Source window will have a short circuit alert to notify the operator about the detected issue.

Short circuit alert.

A drive with a shorted TVS diode cannot be identified or imaged. You can try to run diagnostics on the drive, although it cannot be properly diagnosed and the report will suggest that the TVS diodes should be replaced.

Diagnostics report of a shorted drive.

Image a shorted drive

If you need to image a shorted drive but do not have new TVS diodes on hand to replace the shorted ones, you can image the drive using Insight after removing the diodes.

This process is safe because Insight has short circuit and overvoltage protection, which guards both the imager and the drives connected to it against circuit failures.

To remove the diodes, heat the area of the drive where they are located with a hot fan (such as in a hot air soldering station) and then gently remove them with tweezers.

Once the diodes have been detached, you can plug the drive into Insight and proceed with imaging data from its platters.

Imaging a drive with detached TVS diodes.

How to launch a CLI app after imaging

To launch a command-line interface app after imaging, do the following:

1. Connect your source and target devices to Atola DiskSense 2 hardware unit.
2. Click on the port with your source device.
3. Go to Imaging > Create new session, and then select your target device.
4. On the Start new imaging session screen, find the After imaging section, and then select Launch another app via CLI command.

5. To specify that CLI app to launch, click Command settings.
6. In the Application field, enter the path to the executable file of your application or to your BAT file.

7. In the Arguments field, enter command-line arguments for your application.

   Atola Insight Forensics assists in specifying default arguments of Autopsy, X-Ways, Forensic Explorer, and OSFMount.

   Atola Insight Forensic saves the path to the resulting target image file as a variable and can pass this variable to your CLI app:

   • %1 - full path to the first target image file
   • %2 - full path to the second target image file
   • %3 - full path to the third target image file

   We recommend using %1 in double quotes due to possible spaces in the file path.

8. Optional: To see the possible result of running your application with specified arguments, click Test command.
9. After entering the application path and arguments, click OK.
10. Click Start imaging.

The imaging starts. When it is completed, Atola Insight Forensic launches the specified CLI app against the resulting image and records all the command-line interface commands it runs.

The message that a CLI app has been launched shows in the imaging log.

The report about the results of launching your custom CLI app appears on the Imaging results screen. To view the report and the text output from your CLI app, click on the Result link.

How is segmented hashing different from regular hashing?

With regular hashing, you get a single hash for the entire image.

With segmented hashing, you end up with many hashes of corresponding LBA ranges of the image. The sum of these LBA ranges represents the entire image, though not necessarily in sequential order. You can still prove that the entire image has not been modified by verifying all hashes in a set.

Segmented hashes are saved in a CSV file in this format:

Hash,start LBA,end LBA

Example:
75c92419e86ce82734ef3bbb781e6602 ,0,8388608
e2c7fc5264bae820e46c50b0502236d3 ,8388609,16777216
42718e48b5adb59563c98727cbce0619 ,16777217,25165824
... And so on until the last LBA.

Segmented hashes for multipass imaging

Conventional hashing methods don’t work when imaging an evidence device in a non-linear way, which means no proper hash calculation is possible when imaging damaged evidence drives.

Segmented hashing allows the use of multiple passes and more efficient handling of damaged drives while hashing all the good areas. Hashes are calculated only for the imaged areas, while all bad sectors are excluded from the calculation.

Better resiliency

Another reason to use segmented hashes is to ensure better resiliency against data corruption in the image.

If your acquired evidence image gets damaged in the future, with a regular linear hash you will get a hash mismatch upon verification, and the entire image will become useless. With segmented hashes, only the hash for one segment in the set will become invalid.

Image with segmented hashing

To enable segmented hashing for an imaging session, do the following:

1. Go to Imaging > Create New Session.
2. In the Preset section, click the Show settings link.
3. On the Passes and Hash tab, enable Hash source during imaging.
4. Set the Hash method to Segmented.
5. Adjust other imaging parameters as needed and click Save settings.
6. Click Start imaging.

Segmented hashes are saved in a CSV file in "Hash,start LBA,end LBA" format:

A link to the file with segmented hashes is included in the Imaging Results report.

Verifying segmented hashes

For instance, you have imaged a source drive and calculated its segmented hashes, the CSV file is stored on your computer. Now let's simulate a change of the evidence image to see how Segmented hashing helps us identify the areas, whose integrity has not been compromised.

Step 1. In the top Device panel, select the target image. In the sidebar, go to Device Utilities > Disk Editor. Click Go to sector and enter 35,000,000. Change one byte in this sector and click Save changes.

Changing one byte in Disk Editor

Step 2. In the sidebar, go to Hashing > Verify Segmented Hashes. This is an automated way to verify the segmented hashes in an existing CSV file against the target image. Select the file with segmented hashes calculated during imaging and click Start.

Hash verification

Step 3. Hash verification is in progress. Here we see 18 segmented hashes checked. Hash for the interval that includes sector 35,000,000 is invalid.

Segmented hash verification in progress

Step 4. Hash verification finishes with the proper case report automatically created, also in CSV format.

Segmented hash verification report

This is how segmented hashing helps you avoid the whole image being compromised when a small area of the evidence target is damaged.

Add a hash list

To import a hash list from a file, do the following:

1. Prepare a CSV or text file with a hash list, with one hash per line. For example, a file with two MD5 hashes looks like this:
   • 1777f831255b7f6fa5869acddc2e2c93
   • f6e0fcac265d3e139dd510be0eecb0b1
2. In the Insight Forensic menu bar, select Insight > Preferences or press Ctrl + Q.

3. In the Preferences window, go to the File Recovery tab.
4. On the Hash lists subtab, click the Import hash list link.

5. In the Import hash list dialog, select the file with hashes, enter the hash list name, and select hash list type:
   • White for hashes that belong to the known good files.
   • Black for hashes of the known bad files, such as malware, hacking scripts, hidden illicit data files and more.
   
6. Click Import.
7. Click Apply.

Filter files using hash lists

Once imaging of an evidence drive is finished, you can open its copy in the File Recovery module for a quick analysis. If the file hash belongs to the previously imported white or black hash list, Insight Forensic displays special marks on the left of file hash values:

• ✓ Checkmarks for the files found in the white hash list.
• ⚠ Warning triangles for the files found in the black hash list.

The File Recovery engine can filter files on a target device based on the imported white and black hash lists. To display only the files, which have either white or black hashes, do the following:

1. Select the Target port.
2. In the sidebar, click File Recovery.
3. Click the Scan partitions button.

4. On the Partition selection tab, choose the partition you want to examine and click Open partition.

5. On the top right of the Partition tab, click the Add filter link.

6. Select either Black hash or White hash.
7. Insight Forensic compares every calculated file hash against the selected hash list and displays only the files whose hashes are found in this list.

To learn more about file extraction capabilities for both good and damaged drives, see File Recovery.

Delete a hash list

To delete an existing hash list from Insight Forensic, do the following:

1. In the Insight Forensic menu, select Insight > Preferences or press Ctrl + Q.
2. In the Preferences window, go to the File Recovery tab, and then to the Hash lists subtab.
3. Select the hash list you want to delete, click the Delete icon and confirm your decision.

Detect an ATA password

When a device is connected and identified as locked with an ATA password, there is a corresponding PWD indicator displayed in the port, and Security Status in the Home page says Locked, High or Locked, Maximum.

High and maximum are password protection levels that the operator who locked the device selected. Although information about it may be relevant to the investigator, both security levels are supported by Insight password recovery functionality, therefore this information is not important for the purpose of this guide.

Source device locked with ATA password

To perform a complete Diagnostics, Insight needs to have a hard drive unlocked. Therefore we suggest that when dealing with a locked device, password recovery is performed before running the Automatic Checkup.

Diagnostics showing password lock

Extract password, Reset password and Reset password until power cycle

There are 3 options of dealing with a locked hard drive:

• To extract and display password without unlocking the device.
• To reset password only until power cycle.
• To permanently unlock the device.

Permanently reset password

To permanently reset password and unlock the device, do next steps:

1. Turn off the Write protection switch on the front panel of the DiskSense hardware unit.
2. In the sidebar, go to Device Recovery > Password Recovery.
3. Click Reset.

Unknown password recovery

Password extraction on Hitachi SATA drives

Hitachi drives require the use of the Atola External IDE Adapter which is included in the product package.

1. The adapter plugs straight into the IDE (USB-C) port located on the left side of the DiskSense 2 unit.
2. Hitachi drive must be plugged into SATA port of the adapter.

2.5-inch SATA hard drives (HGST models)

The following actions can only be performed if your SATA drive is attached to DiskSense 2 unit via Atola External IDE Adapter.

1. Connect Atola External IDE Adapter to the IDE (USB-C) port located on the left side of DiskSense 2 unit.

2. Connect the source Hitachi HDD to Atola External IDE Adapter.

3. Place the hard drive as shown on the picture (no need to disconnect any cables):

4. Use a T4 screwdriver to remove four screws as shown below:

5. Put a piece of paper between the circuit board and the hard drive assembly:

6. Do not remove paper; proceed with unlocking.

7. Remove the paper and then put all screws back:

8. Continue with the unlocking process.

2.5-inch SATA hard drives (old models)

The following actions can only be performed if your SATA drive is attached to DiskSense 2 unit via Atola External IDE Adapter.

1. Connect Atola External IDE Adapter to the IDE (USB-C) port located on the left side of DiskSense 2 unit.

2. Connect the source Hitachi HDD to Atola External IDE Adapter.

3. Place the hard drive as shown on the picture (no need to disconnect any cables):

4. Use a T4 screwdriver to remove two screws as shown below:

5. Put a piece of paper between the circuit board and the hard drive assembly:

6. Do not remove paper; proceed with unlocking.

7. Remove the paper and then put all screws back:

8. Continue with the unlocking process.

3.5-inch SATA hard drives

The following actions can only be performed if your SATA drive is attached to DiskSense 2 unit via Atola External IDE Adapter.

1. Place the hard drive as shown on the picture (no need to disconnect any cables):

You may see the orange cable connected to the PCB being fastened by the latch.

2. Important: Power off the drive.

3. Unlock the latch as it is shown below:

4. Disconnect the cable.

5. Proceed following Atola Insight instructions.

6. Important: Power off the drive.

7. Plug the orange connector into the PCB socket and fasten it with the latch.

8. Follow Atola Insight instructions.

2.5-inch IDE hard drives

1. Connect your 2.5-inch IDE drive to the DiskSense 2 unit using the Atola External IDE Adapter:

2. Install a jumper between pins A and C (on the adapter).

3. Attach the hard drive back to the DiskSense 2 unit and proceed with unlocking.

4. Remove the jumper:

5. Plug the hard drive back to the DiskSense 2 unit and continue with unlocking.

3.5-inch IDE hard drives

1. Connect your 3.5-inch IDE drive to the DiskSense 2 unit using the Atola External IDE Adapter:

2. Install a jumper between pins A and C (on the adapter).

3. Attach the hard drive back to the DiskSense 2 unit and proceed with unlocking.

4. Remove the jumper:

5. Plug the hard drive back to the DiskSense 2 unit and continue with unlocking.

Connecting 3.5-inch and 2.5-inch Seagate SATA drives

When you look at a Seagate SATA drive (either 3.5-inch or 2.5-inch), there is a 4-pin jumper block right next to the SATA port.

Connect the 2-mm RX-TX end of the serial cable to the two jumper pins located closest to the SATA port so that the red RX (receive) wire is connected to the pin closer to the SATA port.

Connecting 3.5-inch Seagate IDE drives

Desktop IDE drives have an 8-pin jumper block between IDE port and Power port. For the purpose of this manual, we shall call the pair of pins located closest to the IDE port and used for Master/Slave settings the first pair of pins. The next, second pair of pins is usually used for Cable Select settings. The third pair of pins is the one we will connect the Serial cable to.

Please note that IDE hard drives must be set to Master mode for password extraction and reset or drive recovery. To use the drive in Master mode, place a jumper on the first pair of pins (closest to the IDE port), as shown in the picture below.

Attach the 2.5-mm RX-TX connector to the third pair of jumper pins, as shown in the picture below. Make sure that red RX (receive) wire is facing down and the black TX (transmit) wire is facing up. The second pair and the fourth pair of pins must be left open.

Connecting 2.5-inch Seagate IDE drives

Similar to desktop hard drives, laptop Seagate hard drives also must be set to Master mode to perform password extraction and reset or drive recovery. Master mode on a 2.5-inch device is set by removing all jumpers.

There is a Atola external IDE adapter included in the package with the DiskSense 2 unit.

Use the adapter to connect the drive to IDE interface cable and IDE power cable. Then attach the 2.5-mm RX-TX connector to the left pins vertically, as shown in the picture below. Make sure that the black TX (transmit) wire is connected to the upper pin and red RX (receive) wire is connected to the lower pin.

Configuring the Baud rate

Once the Seagate hard drive is connected to the unit, follow these instructions to configure the Baud rate of Seagate Terminal, which allows you to use an extensive set of commands on a Seagate drive:

1. If there is only one source drive connected to the DiskSense unit, it will automatically be identified and displayed in the Source disk port. However, if there are multiple hard drives connected to the DiskSense unit as Source drives, go to Source category of the top level menu, click on Select Source and choose the Seagate drive.
2. Power down the selected drive.
3. In the Windows category of the top level menu click on Terminal and in the COM Port Settings window select the Baud rate compatible with the drive. Please note that for Seagate 7200.10 and older Baud rate will be 9600; for 7200.11 and newer Baud rate will be 38400 (Atola Insight Forensic will suggest the baud rate by setting a default value in the Terminal window for the drive connected to it).
4. Then click OK. But do not close the Terminal window just yet.
5. Power on the drive again. There must be a valid output in the Terminal window (see the picture below).

Should there be no output in the Terminal window or should it consist of random symbols, try to change the Baud rate until you get a good response.

Now proceed with password extraction or send Seagate Terminal commands to the drive.

Search for artifacts

On the Sidebar, go to Artifacts Finder. In the upper part of the window there is a table with previous artifact searches performed on the current drive including those carried out during imaging. If you want to perform another search, select the artifacts that need to be found.

The artifacts include:

1. Credit cards
2. Emails
3. GPS coordinates
4. IP
5. MAC
6. Phone numbers
7. URL
8. Keywords
9. Regular expressions

For each of the artifacts, not only widely known filter algorithms were applied for proper result filtering (such as the Luhn formula used to validate credit card numbers), but there have also been custom smart filters applied to eliminate false results (e.g. two slashes next a number that has preliminarily been identified as a credit card number, will eliminate it from the search results, as it is likely to be a part of a URL).

Keywords and regular expressions can be added to the search parameters in a txt file with one artifact per line. Keyword encoding can be adjusted to Unicode, Unicode (UTF-8), Unicode (Big-Endian) or US-ASCII.

Browse through the found artifacts

As the Artifact Finder is still running, you can look at the progress in the Artifacts tab below the progress bar and click the diagram to see the list of found artifacts. If you only want to look at a certain category, click it in the list or in the diagram.

In the table, each artifact is given an Id number, each found Value is shown in the context (including 20 bytes before and 20 bytes after the artifact in grey color), the LBA and the offset are also displayed in the table to help locate the artifact.

There are many options to help find, sort, filter and view the artifacts. It is possible to view one or a few categories of artifacts in one list, use the Search bar to find a specific value (search examples are provided in the bottom right corner of the window), filter results for unique values by clicking the Show unique artifacts link. It helps identify the values most frequently occurring on the drive: to sort the results click Count in the table header.

Click an artifact in the list to see the sector where it is located. It allows you to see the context, in which this artifact is placed.

Export the list of found artifacts

During the search, the Export to CSV button is disabled. You can wait until the process is completed or, should it be necessary to start analyzing the current search output with an external tool, stop it, make an export and restart the search from scratch or from the last LBA analyzed during the previous session.

To make an export:

1. Click the link with the number of artifacts found during this search.
2. On the Artifacts screen, select the artifacts to be exported (e.g. one or multiple artifact categories, unique artifacts or only those fitting certain search criteria), and then click the Export to CSV file button.
3. Select the path for the file and click Export.

Launch Disk Editor

To launch the Disk Editor module:

1. In the sidebar, go to Device Utilities > Disk Editor.
2. Click Start reading.

To prevent possible damage to an unstable media, Disk Editor won’t start reading device contents without your command.

Launching the Disk Editor module.

Disk Editor screen explained

The Disk Editor screen consists of three main areas:

1. Toolbar provides quick access to frequently used commands, like Go to sector or Save changes.
2. Hex viewer shows byte-level contents of a device in the hexadecimal format:
   • Left column contains hexadecimal offset values, meaning how far the byte array is from the starting sector of the drive.
   • Central column presents individual bytes in the hexadecimal format.
   • Right column shows corresponding values in the ASCII format.
3. Templates and Data inspector tabs are used to display sector metadata in a human-readable form, search for hex strings, and convert hex values to alternative formats.

Three main areas of the Disk Editor screen: 1 - Toolbar, 2 - Hex viewer, 3 - Templates and Data inspector tabs.

Read sectors using Hex viewer

Insight Forensic seamlessly reads device space in infinite mode: bytes are loaded automatically as you scroll the hex viewer up or down.

To quickly jump to a certain position, click the Go to sector button on the toolbar or press Ctrl+G. Two more convenient shortcuts:

• Ctrl+Home immediately brings you to the first sector of a drive,
• Ctrl+End gets you to the last sector.

To select a single byte, click it in the central column of the Hex viewer. To select multiple bytes, click the first byte of the sequence and drag a cursor to the last byte. Insight also highlights the corresponding ASCII values in the right column.

To save selection to a file, in the toolbar, go to Edit > Save selection to file or press Ctrl+Shift+S.

Locate sector: To find the exact location of a specific sector, click on the sector number with a red pin. Insight detects which files and partitions the sector belongs to and shows the detailed information about the location.

Examine file system structures

After you launch Disk Editor, it detects file system structures automatically and shows known metadata in a human-readable form on the Templates tab.

When you click a field in the Templates tab, Insight highlights the corresponding byte sequence in the Hex viewer.

Navigate through file system structures using a drop-down list at the top of the Templates tab or Back and Forward arrow buttons in the top right corner of the Disk Editor screen.

The Templates tab contains file system metadata in a human-readable form.

Supported metadata structures:

Edit sector contents

As its name suggests, Disk Editor lets you modify any sector contents. You can edit individual bytes directly in the Hex viewer or paste the previously saved byte sequence from a file.

To edit a byte directly, select it in the Hex viewer and enter a new value. You can use standard Copy (Ctrl+C) and Paste (Ctrl+V) commands as well.

To paste the previously saved byte sequence from a file, in the toolbar, select Edit > Paste from file or press Ctrl+Shift+V.

Modified bytes are colored red.

To revert the last changes, use standard Undo (Ctrl+Z) and Redo (Ctrl+V) commands in the Edit menu.

To write modified data, click Save changes on the toolbar or press Ctrl+S.

MBR On/Off button on the toolbar is used in data recovery cases. It swaps the last two bytes of MBR sector #0 to disable partition scanning by Windows.

Search for a string or byte sequence

To quickly find a certain byte sequence, go to the Data inspector tab or press Ctrl+F shortcut and enter a string you are searching for.

If you search the data in the hexadecimal format, select the I am entering HEX code option.

Insight highlights the found string in the Hex viewer.

Use Find previous and Find next buttons to cycle through found byte sequences.

Searching for a hex string in the Disk Editor module.

Interpret bytes with Data inspector

Understand bytes quicker thanks to the Data inspector feature. It converts hex value to decimal (8-, 16-, 24-, 32-bit integer) or binary format on the fly.

Change bytes by entering new values in the respective fields or by selecting or deselecting bits in the Binary format.

Current offset: shows the selected byte position relative to the first sector of the device.

Byte order: switches byte order between Little-endian and Big-endian modes.

8-, 16-, 24-, 32-bit integer: shows selected byte(s) in the respective decimal format.

Binary: shows the first selected byte in the binary format.

Data inspector feature in the Disk Editor module.

Disk Editor keyboard shortcuts

Navigation and search

Editing

How to quickly locate sectors

To run Locate sectors as a separate operation, follow these steps:

1. In the Sidebar, click Locate Sectors.
2. Select sectors to locate, using one of the following options:
   • CSV file: select a CSV file, which contains comma-separated sector ranges.
   • Sector ranges: enter comma-separated individual sector numbers (for example: 501, 607) or sector ranges (for example: 1000-2000).
   • Error sectors of the last imaging session: this option is available if you are locating sectors on a target that contain an image of a drive that had bad sectors.

3. Select the file data you’d like to see in the report:
   • File size
   • Access date
   • Create date
   • Modify date
4. Optional: Insight caches files to speed up the analysis of the sector location. If the cache takes too much space in your Insight work folder, click the Clear cache link at the bottom.

5. Click the Start button. Insight immediately begins locating the sectors.

6. After processing all the scheduled sectors, Insight generates a report listing where the sectors have landed in relation to individual files and the file system as a whole.

Locate bad sectors in the Imaging Results report

After an imaging session is completed, Insight generates the Imaging Results report. If Insight runs across bad sectors, it reflects them in the report and the operator is offered a few options for working with bad sectors.

To detect which files and partitions these bad sectors belong to, launch the Locate sectors operation by clicking the Locate bad sectors link.

Locate sectors in the HEX viewer

The HEX viewer is integrated into a few modules of Insight: Artifact Finder, Disk Editor and File Signatures.

To use the HEX viewer for analyzing to which file on the drive a found artifact belongs, do the following:

1. In the Sidebar, click Artifact Finder.
2. Set the parameters of your search and start the process. For guidance, see Search for artifacts.
3. Whether the search is ongoing or finished, you can start examining the output of the found artifacts in the table: filter, sort, and search for individual artifacts.
4. By double-clicking on an artifact, you open the Hex viewer window/tab, which shows the artifact within the sector where it was found.
5. To find the file to which this sector belongs, click the red pin icon next to the sector number.

Similarly, you can look up how a signature encountered during imaging relates to the file system.

If the imaging has been completed: look up the signature list in the imaging report and then on an individual signature, this will open the HEX viewer window. By clicking the red pin icon in the sector view, you will see which file the found signature belongs to.

If the artifact does not belong to a file, it may be remnants of the data of a file deleted by the user.

Detect HPA, DCO, or AMA restrictions

When you connect a hard drive to the DiskSense unit, in addition to the standard Identify device command, Atola Insight Forensic automatically sends commands to look up the drive size as set in the drive’s firmware.

If drive size is limited by HPA, DCO, or AMA, Insight draws attention to these changes by adding corresponding red indicators to the DiskSense Source Port.

To get more details about the modifications that have been made to the drive’s firmware, run Automatic Checkup.

AMA limitation is indicated in the Diagnostics results.

In the Firmware section of the Diagnostics report, there are two (for AMA) or three (for HPA and DCO) of the following lines, indicating the drive’s Max Address according to different records in the drive’s firmware:

• The Max Address according to device ID line shows the max address from the ID sector, affected by DCO and HPA/AMA restrictions if those are applied.
• Accessible Max Address indicates max address ignoring AMA limitation that may have been enabled.
• Native Max Address indicates max address ignoring HPA limitation that may have been enabled, yet affected by DCO restriction.
• Max Address from DCO is the line that gives you the actual drive size.

A Diagnostics report of a drive that does not have HPA, DCO, or AMA activated will have the same value in all these lines.

AMA restriction details in the Firmware section of the Diagnostics report.

HPA and DCO restriction details in the Firmware section of the Diagnostics report.

Unclip HPA/DCO/AMA restrictions

To lift any restrictions that have been applied to the drive’s firmware:

• Disable Write protection using the physical switch situated on the front panel of the DiskSense unit. The respective LED indicator turns off. Unclipping HPA/DCO/AMA implies making changes to the drive's firmware, and Write protection won't let perform such changes.
• Go to Device Utilities > Unclip HPA/DCO/AMA.
• Click the Unclip button.

Unclipping HPA/DCO/AMA.

Insight Forensic lifts HPA, DCO, or AMA restrictions in a matter of seconds and enables access to all data on the drive.

HPA and DCO restrictions have been removed.

Change HPA max address temporarily (until power cycle)

To ensure a forensically sound process, it can be necessary to avoid making any changes to the drive. Therefore it is prohibited to disable HPA and DCO restrictions and access data in the hidden areas.

With Insight Forensic it is possible to lift HPA restriction until the next power cycle. This helps avoid permanent changes to the drive.

To unclip HPA on the source drive until the next power cycle before imaging:

1. In the sidebar, go to Device Utilities > Host Protected Area.
2. Click the Read HPA parameters link.
3. Click Set as current to automatically change the Current Max Address value to that of the Native Max Address.
4. Select the Change Max Address temporarily (until power cycle) option.
5. Click the Change Max Address button.

Changing HPA max address until power cycle.

This will allow access to the data in the area previously protected by HPA, yet as soon as you power off or detach the drive, the HPA will be in place again.

For more information about imaging of freezing drives, see Imaging freezing damaged drives.

Set or change HPA, DCO, and AMA restrictions

Not all drives support hidden areas. The DCO and HPA can co-exist on the same drive: max address limited via HPA should be less than DCO. AMA is supported by new drives and can't exist if DCO or HPA is supported, and vice versa.

If your target device is larger than your source device, but you need hash values for the source and for the target devices to be identical, see Clip target drive to source evidence size.

To set or change DCO restriction:

1. Disable Write protection using the physical switch situated on the front panel of the DiskSense unit. The respective LED indicator turns off.
2. Go to Device Utilities > Device Configuration.
3. Click the Read device configuration link.
4. Enter a new Max LBA address.
5. Click Save configuration.

Setting a new Max LBA address using DCO.

To set or change HPA restriction:

1. Disable Write protection using the physical switch situated on the front panel of the DiskSense unit. The respective LED indicator turns off.
2. Go to Device Utilities > Host Protected Area.
3. Click the Read HPA parameters link.
4. Enter a new Current Max Address. The max address limited via HPA should be less than the Max LBA address set using DCO.
5. Optional: Check the Change Max Address temporarily (until power cycle) option if needed.
6. Click the Change Max Address button.

Setting a new HPA restriction.

To set or change AMA restriction:

1. Disable Write protection using the physical switch situated on the front panel of the DiskSense unit. The respective LED indicator turns off.
2. Go to Device Utilities > Accessible Max Address.
3. Click the Read AMA parameters link.
4. Enter a new Current Max Address.
5. Click the Change Max Address button.

Setting a new AMA restriction.

Add or change the case number and description

1. In the top right, click the Plus icon next to the Case Number.

The Plus icon next to the Case Number.

2. Enter or change the Case Number and Description.

Changing case details.

1. Click OK. The description appears next to the Case History.
   For quick changes, you can also click the Change link right below the description.

Case description added

Add a document or an image to the case

1. On the case Home screen, in the Case history section, click the green Plus icon.

Adding a file to the case.

2. In the Attach File dialog, enter the path to a file and leave a comment in the corresponding field.
3. Optional: Select Copy to work folder to copy the file to the same folder where any other related files are located, for example, tables with segmented hashes, logs, imaging maps, file signature lists and more.

The Attach file dialog.

4. Click Attach. All the uploaded files appear on the case Home screen below the description.

View or remove the attached files

To view all the attached files, change their details, or remove them from the case, click the Manage attached files link.

The Attached files window contains the list of files including

• an icon representing the file type,
• the name,
• the folder where the file is located,
• the date when the file was attached to the case and
• the comment added by the user.

To edit the Comment or copy the file to the case folder, right-click a file and select Edit.

To remove the file from the case, select the file and click Remove.

Export cases

Whenever cases need to be transferred from one computer to another one, start by exporting the cases.

1. In the Menu bar, go to Cases > Export.
2. In the Export Cases window, select the folder where the cases should be stored.
3. Select the cases you want to export and click the Save button.


Export selected cases

4. Insight saves cases as a package in a zip file with the default name Cases.Package.zip. Later you can copy this file to a different computer.
5. Once a case is exported, Insight adds a record about it to the case’s history.


Case export report

Import cases

To import cases from a zip file into Insight on a different computer, do the following:

1. In the Menu bar, go to Cases > Import or press Ctrl + I.
2. Click the Browse icon and open the zip file with saves cases.


Importing cases

3. Select some or all of the cases in the table and click the Import button.


Importing cases selectively

If there is a match between existing case numbers and the imported ones, Insight will prompt you to either cancel the import or save the case that causes the conflict as a copy.



Ways to resolve import conflicts

General

Imaging and performance

Damaged media & File recovery

Diagnostics

Hashing

Fill/Erase

Case Management

Device Recovery