Atola Insight Forensic
An outstanding data acquisition tool for forensic and data recovery experts:
Supports USB devices (USB 3.0 speed)
Images drives and SSDs faster than any other tool
HDD duplication/backup image creation to up to three targets (SATA, IDE, USB 3.0) even in mixed mode
Ability to run multiple concurrent tasks
HDD diagnostics was never implemented this well before in either software or hardware. The diagnostic process reports the exact problem with the drive, whether it is a PCB (electronic) or head failure, media damage,motor freezing, firmware area damage or file system damage.
The Atola Insight Forensic can work in fully automatic mode: it can automatically diagnose all hard disks componentsand let the operator know what the exact problem is and how to fix it; it can also automatically repair the firmwareand show/remove ATA-passwords (User or Master, any security level) of supported hdd.
Outstanding speed: The cloning is supported to up to three targets - with unmatched speed - a perfect feature for any type of business: Forensic specialists, repair shops, data recovery or investigative organisations.
Automatic in-depth diagnostic of all hard drive components
Automatic password extraction / removal of supported hdd
Firmware area backup system of supported hdd
Real time current monitor
Fastest imaging tool of the industry
High performance multi-pass-imaging - even of defect hdd
Built in write blocker
Hash calculation: MD5, SHA1, SHA224, SHA256, SHA384, SHA512
File recovery for NTFS (all versions), Ext 2/3/4, HFS, HFS+, HFSX, ExFAT, FAT16, FAT32
Case management system
Network forensics via SSH
Serial portfor firmware area access of some hard drives
Power control to take full control over the hard disks power. The protected power source for attached hard driveswill withstand any overload condition, including a short circuit.
Real time current monitorfor monitoring the 5V and 12V currents separately. The data received from the monitor not only serves asa short-circuit protection, but also used for hard drive diagnostics (to detect motor damage, burnt circuits, etc). The oscilloscope allows the operator to keep an eye on hard drive power consumption levels.
LED indicatordisplay the status of the HDD power, operation/error status, IDE/SATA (BUSY/DATA) and RS-232 port activity.
Write protection switch Turned on it disables a write operation to the source drive
In-depth diagnostics is needed for each and every hard drive that comes in for data recovery service. Atola Insight can test all hard drive components:
Electronics (circuit board)
Partitions and file systems
Atola DiskSense unit has short-circuit protection on board, thus enabling you to diagnose severely damaged hard drives.
The diagnostics can be performed in fully automatic mode. Automatic diagnostics allows to determine the exact issue with the hard drive.
Real time current monitor
The data collected by the current monitor is used for automatic hard drive diagnostics (to detect frozen motor, damaged electronics, etc). 5V and 12V currents are monitored separately.
Atola Insight also includes an oscilloscope that allows the operator to watch hard drive power consumption levels. There are two kinds of oscilloscope in Atola Insight: full-size monitor and tiny monitor. Tiny monitor can always stay on the screen allowing to always keep an eye on hard drive’s power consumption, whereas full size monitor provides more details.
The image below shows normal spin-up and initialization currents (5V and 12V) for a desktop hard drive.
Full-size real time current monitor in Atola Insight
Media Scan reveals read delays and errors (bad sectors). While scanning, two graphs are created: one shows the exact time needed to read a block of sectors (in milliseconds), another shows the speed in megabytes per second. Media Scan is used to determine surface and head damage.
The image below shows media scan graphs of a good hard drive:
Testing a good hard drive
An example of how it will look on a damaged surface:
Significant delays (over 20ms average per block) show that there is media damage
Note that yellow peaks do not represent bad blocks. However, they show that it was hard to read those sectors (hard drive did a lot of re-reads and ECC correction).
Patterns of significant delays and errors suggest head damage
In this example you can see patterns of significant delays and read errors. This is a clear indication of a head failure.
Fully automatic disk checkup does everything: checks hard drive’s electronics, motor, head stack, media surface, all firmware/system areas, partitions and file systems. After the check, the exact issue is determined.
In most cases the software is able to suggest the exact steps to get the recovery done.