The tool is developed by a team of industry renowned data recovery engineers in collaboration with law enforcement agencies and forensic experts from around the globe.
- Atola Insight Forensic software (runs on any Windows PC or laptop)
- DiskSense hardware unit
Forensic and E-Discovery solution
All features of the system are designed to support damaged media. Where other Forensic data acquisition products stall or abort on media errors, Insight Forensic can acquire a usable image.When dealing with good (non-damaged) media, Insight Forensic acquires data faster than any other data acquisition equipment commercially available.
The system has several key features for data capture in forensic and e-discovery cases:
- Fastest in industry imaging speed up to 418 MB/s
- High performance multi-pass imaging for damaged drives
- In-depth Automatic HDD diagnostics
- Extraction of unknown ATA Passwords
- Case management system prepares acquisition reports automatically
- Hash calculation: MD5, SHA1, SHA224, SHA256, SHA384, SHA512
- Forensic data erasure methods including DoD 5220.22-M, Security Erase, NIST 800-88, Pattern Erase
- File recovery for NTFS (all versions), Ext 2/3/4, HFS, HFS+, HFSX, ExFAT, FAT16, FAT32
- Support for SATA, IDE, USB media
- Built-in write blocker
- Network forensics via SSH
Acquiring data from damaged media
1. HDD Diagnosis
A successful acquisition job starts with accurate diagnosis of the media. The Insight Forensic is the ONLY product in both data recovery and forensic industries with the ability to accurately evaluate a hard drive’s health and pinpoint specific problems. This feature puts our users at a major advantage by enabling them to take all factors into account before moving forward with data acquisition.
2. ATA Password Removal and Firmware recovery
The system properly recognizes locked hard drives and allows for a fully automated extraction or removal of an unknown ATA password with a single click of a button.
When a hard drive is experiencing firmware problems, it is not usually accessible using conventional data acquisition tools or imaging utilities. The Insight Forensic recognizes firmware corruption using its advanced diagnostic module and repairs it with the click of a button for supported HDD models. For non-supported HDD models, the Insight recognizes firmware corruption and provides direct access to firmware files (modules), enabling expert technicians to manually repair the corruption.
3. HDD Duplication / Backup Image Creation
Extracting every fragment of data from hard drive is a crucial part of the data acquisition process. The Insight’s duplication/imaging system allows the user to completely customize the imaging process to suit each job, even when dealing with damaged or unstable media.
This module now comes standard with SELECTIVE HEAD IMAGING, allowing the operator to identify the status of individual read/write head and create an individual imaging approach for each one.
4. File Recovery
File recovery is the last phase of most data acquisition jobs. The Insight’s file recovery engine is simple, intuitive, and effective. It integrates seamlessly with Disk Duplication and Case Management systems to effectively extract data.
Advanced password removal capability
Insight Forensic automatically removes ATA passwords from hard drives in just 2 minutes. This highly complex feature can be executed by the operator with one click of a button and the password is displayed after it is removed whenever possible.
Well-rounded feature set
Insight Forensic comes equipped with a range of utility features for each step of the data acquisition process. These features include device configuration for modifying hard drive parameters, HDD current monitoring for continuous diagnosis, a disk editor for modifying hard drive data, and an add/remove password function.
Smooth case management from start to finish
Insight Forensic is the only data recovery product that was built with case management in mind. All functions are tied in to one-another and the system tracks and records every action taken with a given hard drive. If a session is stopped and the hard drive is disconnected from Insight and then later reconnected, the system will recognize the hard drive and give the operator the option to re-open the case.