My DiskSense hardware unit does not boot
It is very likely that there is a USB device plugged into the unit, which prevents it from booting properly. Try detaching all USB cables and restart the hardware unit. If that has not worked, follow these steps to fully reset:
The previous boot attempt was interrupted and now the unit does not boot
Connect a monitor directly to the unit's HDMI or VGA port. If you see a BIOS message saying Would you like to restore Fastboot on the next boot? (Y/N), it is likely that the previous booting got interrupted at a specific booting moment.
The most straightforward recipe here is to plug a USB keyboard into one of the USB ports and press the N button. After the unit has booted successfully, please restart it again to make sure the next booting cycle is smooth.
How do I reset the IP address of the hardware unit
You can reset DiskSense unit's IP by holding the small IP RST button on the backside. You should keep holding the button until the PWR LED stops blinking. Then unit's IP must be reset to 192.168.0.188 and 10.0.0.188.
How to change the hardware unit's IP
The system has been designed to work in the most commonly used networks and has IP addresses 10.0.0.188; 172.16.0.188; 192.168.0.188; 169.254.0.188.
If your network has one of these subnets (10.0.0.*; 172.16.0.*; 192.168.0.*; 169.254.0.*), and the IP address ending with 188 is free, you can simply connect the unit to the network. Then run Insight software, select default unit IP ending with 188, and click Insight -> Modify DiskSense Unit IP.
If your network has a different subnet address, follow these steps:
I am able to ping the Insight's hardware unit but cannot connect to it
Here are the possible reasons:
Should these steps prove ineffective, try updating your PC's Windows install.
Insight software is stuck in Searching for DiskSense unit window
It appears that your unit's HASP is not detected. Please check if you can still ping DiskSense unit IP address from Windows PC. Then try the following:
Remote License Search Parameters must be either empty or contain the DiskSense IP address (the latter is preferable).
I connected DiskSense directly to my PC's second Ethernet cards but I cannot ping it or connect to it.
First and foremost, please check whether you can ping the unit when it is connected directly via your 2nd Ethernet adapter.
Connection losses occur when I use the USB-to-Ethernet adapter (NIC)
Certain platforms have issues with these adapters, and such issues may occur after large amounts of data have been transferred. It may be a USB-related issue: a memory leak in the USB driver which accumulates after a few days of high-speed transfers.
Try replacing the adapter with a similar one:
Windows 10 32-bit. hardlock.sys error during installation
It looks like a HASP (dongle) run-time installation issue. You can install the newest run-time following an alternative scenario:
haspdinst.exe -r -fr -kp -fss -purge
haspdinst.exe -i -fi -kp -fss
Windows blue screen when launching Atola Insight Forensic
Microsoft updated Windows 10 (October 2020), and it broke the support of the HASP run-time v6.60.
The issue will be fixed in Atola Insight Forensic 4.17. For already released software versions (4.16 and older), please download and install the newest run-time following these steps:
After database setup, there are missing cases in the Search window.
Most likely, you selected either either incorrect Work Folder or SQL Server.
Insight's database consists of SQL Server data and Work folder files. Large files like imaging maps, file signatures, artifacts, report logs are saved in the Work folder. While the case information, including report data, is stored on an SQL Server.
Two Insight settings refer to that:
\\networkpath\Atola is the work folder we need. First of all, it must be specified in the Insight -> Preferences -> Work folder path setting.
Also, it is important to find corresponding SQL Server database. If you know the names of the computer, SQL server and database, follow these steps.
If cases do not appear, try different combinations of database name, SQL server name, computer name.
How do I change the path to the Work Folder?
To change the path to the Work Folder, go to Insight > Preferences > Work folder path, change the directory and click the Apply button.
I am running out of free storage space in Work folder
Depending on the features and the settings you use, Insight saves different kinds of data in its Work Folder.
After I changed the Work folder, files from the previously created cases have not been moved to the new folder
This can be done manually:
Mapped network drive is unavailable during Image File selection
The shared folder mapped as a network drive to the local PC is unavailable. The issue happens in Windows 10 and is caused by Microsoft's native components we use to select files.
Microsoft explains this with UAC being enabled and suggests editing the Windows registry as a workaround.
NB the mapped network drive is just a shortcut for the longer network path. Always select Network part of tree view and select the same network folder. Insight will remember the last selected path and open it when you select another image file.
Insight can't identify a Seagate drive and shows an inaccurate device capacity
Zero-capacity implies typically firmware issues which may be corrected via serial port in the case of Seagate drives. Atola Insight Forensic enables to take advantage of serial connection.
We do not have many guides about fixing specific Seagate issues, which would require a profound knowledge of Seagate terminal command system. But here is another article in the manual that may be helpful.
Seagate. Turn off bad sector reallocation (or clear G-LIst)
Unfortunately, Insight does not handle bad sector reallocation automatically. You may find more info on data recovery forums by searching for:
Here is the information about terminal commands for modern Seagate drives.
Artifact finder does not find artifacts in files (.pdf, .pst, .docx, etc.)
Artifact finder performs low-level sector-by-sector search without parsing file structure and interpreting each type of file (.pdf, .pst, .docx).
Instead, Insight's search engine detects keywords, IP addresses, URLs, and other artifacts in raw drive space. This way, it complements the traditional analysis via Magnet AXIOM, X-Ways Forensics, etc.
Another benefit of Insight's artifact search: it goes through the whole drive space, including unallocated space. It helps find evidence at the sector level, where other tools could miss it.
I don't seem to be able to unlock an SSD or a USB drive with Insight
Insight supports unlocking passwords of a limited range of drives. While we would like to provide you with maximum support, it is impossible due to the firmware of different drive families being very vendor-specific. Please check the list of supported drives.
We have primarily developed this functionality for hard drives, but extending this functionality for SSDs or USBs would require a prohibitive amount of work to support the huge range of firmware types and controllers. Unfortunately, this functionality has not been the focus of our attention.
Encase does not open an E01 file created by Insight
E01 files have a problem opening in Encase typically due to a file handle held by Insight. It can manifest itself in CRC errors during Encase verification. To resolve it, close the E01 file's port in the top panel in Insight before opening the file in Encase.
It helps to know that Encase caches unsuccessful verification results for the E01 file (or E01 file with the same metadata). So it may be necessary to clear the cache or start a new case in Encase application.
Max path length / folder length
Make sure that the path length has not exceeded the limit set in Windows API.
Atola Insight supports the maximum path of 32,767 characters.
Since you are not able to move the files using Windows Explorer, you can take advantage of subst command to shorten the file path for the file(s). Here is the easiest way to fix this:
A USB drive imaging produces read errors
To eliminate the possibility of faulty cables, it may be worth investing in short, high-quality USB3 cables. Longer, lower-quality USB3 cables can produce read errors during acquisition.
Non-working USB flash or USB port
It's very unlikely you have a faulty DiskSense system. Moreover, bearing in mind all USB ports are native motherboard ports without any adapters in between. Nevertheless, let's try to make diagnostics and find out what works and what does not:
This is a clear test for USB ports. It would be great if you can run the scenario several times with different USB flash drives. Pay attention that the 2nd step (power cycle the DiskSense system) is a must to have clear test results.
Serial COM port (RS-233). Unlock problem
First and foremost, I would ask to double-check whether the serial cable connection and selected baud rate are correct. Here is the easiest way: