Data Recovery Tool

Atola Insight Forensic Model: DEY-AIF An all-in-one data recovery and forensic acquisition system for professional use. It offers efficient data retrieval functions along with versatile disk utilities. Special Features: • Works with both good and damaged media
• Support HDD, SSD and flash device
• ATA password removal/extraction and firmware recovery

Description

Atola Insight Forensic is an all-in-one data recovery and forensic acquisition system for professional use. Compacted in a small and light hardware unit and a user-friendly software, it offers versatile data retrieval functions along with utilities for manually accessing hard drives at the lowest level.

Created by a team of outstanding data recovery industry engineers in collaboration with law enforcement agencies, private investigators and forensic experts from around the globe, it is the best-on-market data acquisition solution in forensic and e-Discovery cases.

Technical Info

Item Description
Product Name Atola Insight Forensic
Model DEY-AIF
Media Interface SATA I/II/III, USB 1/2/3, IDE, extension ports
Source Ports SATA3.0, USB3.0, IDE (Write protection switch for source ports)
Flash card support via card reader attached to any USB port
Target Ports SATA ports x 3, USB3.0 (SuperSpeed) x 3
Extension Ports SAS, 10GBit Ethernet, Apple PCIe SSD, M.2 PCIe/SATA SSD
Other Ports Serial RS232 port
Other Ports Serial RS232 port
Ethernet Interface 2 x RJ45/1Gbe. One of them can be used for Network Forensics.
Internal OS Linux running a custom kernel
Power Consumption 60 Watt average, 200 Watt peak
Supply Voltage 100-240V VAC, 50-60 Hz
Dimensions 196 X 182 X 54 MM
Weight 1.3 KG
Specifications are subject to change without notice


Key Features

• Supports SATA, IDE, USB media including hard drives, USB flash devices, USB card reader etc.
• Optional native Apple SSD support via a new PCIe adapter (2013-current Mac models)
• Support native 4K-sector USB devices (eg. iPod)
• In-depth Automatic HDD diagnostics
• Fastest in industry imaging speed up to 418 MB/s
• High performance multi-pass imaging for damaged drives
• Imaging to multiple targets
• Show the speed of each drive involved in imaging to allow the user to locate bottlenecks
• Extraction of unknown ATA Passwords
• Sophisticated while user-friendly firmware recovery system
• File recovery for NTFS (all versions), Ext 2/3/4, HFS, HFS+, HFSX, ExFAT, FAT16, FAT32
• Improved searching in File Recovery – find by signature, size, attributes or hash
• Forensic data erasure methods including DoD 5220.22-M, Security Erase, NIST 800-88, Pattern Erase
• Hash calculation: MD5, SHA1, SHA224, SHA256, SHA384, SHA512
• File hash calculation in background
• File hash export
• Network forensics via SSH (secondary Ethernet port for remote SSH access)
• Case management system prepares acquisition reports automatically
• Able to run multiple concurrent tasks over different hard drives, images, USB devices
• Can change IP via Insight > Modify DiskSense Unit IP menu
• Built-in write blocker
• User-friendly software interface
• Improved Help with a list of all keyboard shortcuts
• Equipped with 9 ports: one SATA source, one USB source, one IDE source, 3 SATA targets, 3 USB targets
• Small and light hardware unit

Supported Drives

Atola Insight Forensic supports all 1.8-inch, 2.5-inch, 3.5-inch IDE, SATA and USB hard drives, USB Flash media as well as SD, Compactflash, and Memory Stick cards via a generic USB Card Reader.

Atola Insight Forensic can also work with the newest PCIe SSDs from Apple MacBooks (2013 - current models) via proprietary Atola adapter.

Most functions of the Atola Insight Forensic will work with any hard drive or flash card with either IDE, SATA-1/2/3 or USB-1/2/3 interface (including those attached via adapters).

However, there are three functions that only work with specific hard drive model families:
• Automatic password removal
• Head selection in Imaging and Media Scan
• Full firmware access

1. Automatic password removal works for the following models

• SATA and IDE Seagate hard drives (including F3 series)
• SATA and IDE Western Digital hard drives
• SATA and IDE Toshiba hard drives: MK, MQ, DT families
• SATA and IDE Maxtor hard drives
• SATA and IDE Samsung hard drives with the exception of old hard drives made prior to 2004 and some latest models
• SATA and IDE Fujitsu hard drives with the exception of latest models (MHW and newer)
• The following Hitachi Travelstar hard drives are supported: IC25NxxxATMRxx, HTxxxxxxxM9ATxx, HTxxxxxxxG9ATxx, HTxxxxxxxG9SAxx, HTxxxxxxxH9ATxx, HTxxxxxxxH9SAxx, HTxxxxxxxJ9ATxx, HTxxxxxxxJ9SAxx, HTxxxxxxxK9ATxx, HTxxxxxxxK9SAxx, HTxxxxxxxL9SAxx, HTxxxxxxxB9A3xx.
• The following Hitachi DK hard drives are supported: DK23DA, DK23EA, DK23FA.
• The following Hitachi Endurastar hard drives are supported: J4K50 (HEJxxxxxxF9ATxx), N4K50 (HENxxxxxxF9ATxx).
• Hitachi hard drives supported in Insight Forensic 4.3: HTxxxxxxxA9A3xx, HTxxxxxxxA7E6xx, HTxxxxxxxA9E6xx, HDxxxxxxxCLA3xx, HUxxxxxxxCLA3xx

• Please note that due to the wide variety of firmware revisions released by hard drive manufacturers, it is impossible to guarantee that the password removal will always work. Hence, password removal may fail on a small percentage of hard drives.

2. Head selection works for the following models

• SATA and IDE Seagate hard drives (including F3 series)
• SATA and IDE Western Digital hard drives
• SATA and IDE Hitachi hard drives
• SATA and IDE Toshiba hard drives: MK, MQ, DT families

3. Full firmware access

• Western Digital hard drives: all IDE and SATA models are supported
• Fujitsu hard drives: all IDE and SATA models are supported
• Samsung hard drives: all IDE and SATA models are supported with the exception of old hard drives made prior to 2004
• The following Hitachi hard drives are supported: ATMR, M9AT, G9AT, G9SA, H9AT, H9SA, J9AT, J9SA, K9AT, K9SA, L9SA, B9A3, PLA3, PLAT, ATCS, DLA3, DLAT, VLAT, DTLA, AVER, AVVA, AVVN, AVV2, ATDA, DPTA, DADA, DARA, DBCA, DCXA, DHEA, DTTA, DJNA, DJSA, DKLA, DTCA
• Hitachi hard drives supported in Insight Forensic 4.3: A9A3, ALA6, A7E6, A9E6, CLA3
• Toshiba hard drives supported in Insight Forensic 4.3: DT family only

Diagnostics

Diagnose Unrecognizable HDD
Accurately diagnose hard drives that cannot be recognized or identified by other tools.

Automatic Checkup
Automatically diagnoses Circuit Board (PCB), motor, each head, media surface, firmware, partitions and file systems, identifies specific errors and recommends steps for moving forward with HDD recovery and data extraction.

Media Scan
Displays read-speed for any range of sectors. The additional "Fast Scan" mode reads small select areas throughout the entire media to save time.



Current Monitoring
Has a Dual Oscilloscope that monitors the 5 volt and 12 volt currents being drawn by the hard drive in real time, so that the user can track the electrical behavior of the hard drive throughout the entire data recovery process.



Diagnose Multiple Malfunctions
In some cases, the Atola Insight Forensic can identify multiple failures of a hard drive at once.

ATA Password Removal

• Automatically checks the hard drive's security status
• Unlock the drive, or extract and view the password without unlocking
• Password is extracted in less than 2 minutes
• Unlocking or extracting has no impact on MD5 or SHA hash values

Firmware recovery

• Recognizes firmware corruption and repairs it with a single click for supported HDD models.
• For non-supported HDD models, recognizes firmware corruption and provides direct access to firmware files (modules) for expert technicians to manually repair the corruption. Firmware files can be quickly and easily edited, verified, replaced, or erased using the system's smooth and user-friendly interface.
• Quickly and easily backup firmware files, for later use during the same case or future use in cases involving the same hard drive models.

HDD Duplication

Selective Head Imaging
Allows the user to identify damaged read/write heads so that he can adjust the imaging approach to start by reading from good heads and then going back to the damaged heads. This feature helps to avoid the need to swap heads.

Imaging Damaged Drives
Provide the best possible results in the shortest amount of time by its featured multi-pass imaging, imaging from good heads only, and other great capabilities.

Imaging to Multiple Targets
Images source media onto one, two or three targets simultaneously.

Customize Every Step
• Completely customize the imaging process to suit special needs in each job.
• All parameters can be adjusted in a very simple way to fine-tune the process.

Copy to Image
Copy the source disk into an image file quickly and easily by selecting a storage location on the host PC and specify the image file size (put all data in a single image file or "chop" the data into a series of smaller chunks).

Data-Only Copy
Only copy occupied sectors to greatly save time and relieve strain on the source hard drive (supported file systems: NTFS (all versions), Ext 2/3/4, HFS, HFS+, HFSX, ExFAT, FAT16, FAT32).

Metadata-only Imaging
Select to image all sectors with metadata. Metadata-only imaging mode allows for imaging of specific files.

Image Specific Files
After imaging with “All sectors with metadata” finishes, select specific files in File Recovery module and copy data of the selected files.

Automated Sector Analysis When viewing sectors, known metadata is automatically parsed into a human-readable form.

Bad Sector Map
Creates a Bad Sector Map at the end of the duplication process to support the subsequent File Recovery module.

File Recovery

File Extraction Capabilities
• Finds and extracts file data and provides additional information regarding file status, for both good and damaged drives.
• Supports all versions of most popular operating systems: Windows, Mac OS X and Linux.

Status for Each File
Shows status of each file, such as what percentage of file was imaged without errors, which files are damaged and to what degree.



Effective Reporting
Automatically creates a full report listing files successfully recovered, files not successfully recovered, and files with skipped sectors.

Disk Utilities

• Set and remove ATA passwords quickly and easily.
• Fill or erase hard drives (supported wiping methods: Zero-fill, Custom pattern, LBA number in each sector, Security Erase, DoD 5220.22-M, NIST 800-88).
• Performs hash calculation for both source and target drives simultaneously via a separate Calculate Hash menu.
• Take full control of hard drive HPA feature sets by changing the max address to any specified LBA in both LBA28 and LBA48 modes.
• Compare data stored on any 2 or more devices sector-by-sector.

Extensions

SAS extension module
• SAS interface: 6 Gbit/s
• Max read/write speed: 500 MB/s
• Damaged drive support
• Hotplug for SAS drives is supported
• Current sensing is supported
• Short circuit and overvoltage protection is active
• Write protection



10GBit Ethernet extension module
• Max possible transfer speed: 10 GBit/s
• Transfer speed received in practice: 400 MB/s
• 10G copper standard
• RJ45 (8P8C) connector interface
• Cat 6 Ethernet cable recommended for optimum performance



Apple PCIe SSD extension module
• Drive imaging with 400 MB/s speed (24 GB/min)
• Damaged drive support
• SSD Trim
• Calculate hash
• Comparison with pattern, image files or other drives
• Media scan
• Various device utilities: disk editor, media recovery, etc.
• Write protection



M.2 PCIe/SATA SSD extension module
• Max read/write speed: 500 MB/s
• Damaged drive support
• SSD Trim
• Calculate hash
• Comparison with pattern, image files or other drives
• Media scan
• Various device utilities: disk editor, media recovery, etc.
• Write protection
Back