Atola Forensic Imager

Disk Duplication

All hard drive imagers are not created equal

Hard drive duplication is a very important part of the data recovery process. Trying to recover data directly from the original HDD is dangerous because the hard drive can fail at any moment and result in permanent data loss. This means the technician must transfer the data quickly and safely from the original HDD to a backup HDD and then proceed using the backup. When the original HDD is imaged, the user must be 100% certain that all usable bits of data have been extracted from and transferred to the backup. The Atola Forensic Imager is the industry’s most effective system for imaging hard drives quickly and safely, while extracting the maximum amount of data. It allows the user to set every part of the process in order to customize the imaging approach to best suit each data recovery case.

Click here to skip to this section’s FAQ at the bottom of the page

Flexible settings

The Atola Forensic Imager is able to image entire hard drives, selected partitions or specified sector ranges. The newly created image can be stored either on a destination hard drive or the host computer. A data wipe function is also available to quickly and easily write a null pattern to the destination hard drive (example: 00, FF, or E5) if necessary to prepare it for a new image.

Customize every step of the process

The Atola Forensic Imager enables the user to create the perfect imaging process to meet the needs of a project by adjusting simple parameters. These parameters can be applied to any range of sectors or any single read/write head. Multiple read-passes can be created for a number of reasons (example: quickly extract data from healthy sectors before going back to focus on damaged sectors). No complex coding or difficult, time consuming steps are needed because customization is simply built into the user interface. Please see the video at the bottom of the page for examples of setting parameters.

Main Imaging Parameters:

• Specify read/write heads to transfer from
• Timeout length (after failed sector read attempt)
• Number of sectors to skip after failed read attempts
• Number of imaging passes
• Apply Read-Long command on last pass
• Reduce HDD operating speed to PIO mode
• Calculate checksum (MD5, SHA (1, 224, 256, 384, 512))
• Disable GList auto reallocation
• Copy direction (forward/linear or reverse)
• Abort duplication if after X amount of HDD power cycles

In-depth status monitoring

The Atola Forensic Imager's real-time status monitoring system is detailed and easy to read with Case Management and File Recovery modules. At a glance, it communicates vital information to the user (such as total number of errors and last block read) in both digital and graphical form. Based on the data being displayed throughout the imaging process, the user has the option of making on-the-fly changes to the imaging parameters. The user can even add another imaging pass to the end of the function to revisit areas with multiple errors and apply different parameters. When the imaging pass is complete, all status information is automatically sent to the Case Management and File Recovery modules.

Data-Only copy option

This option gives the user the ability to only copy occupied sectors from the source hard drive. This can greatly reduce copy time and relieve strain on the source hard drive. Please note that this function should only be used for hard drives that are NOT severely damaged.

Image file creation

Copying the source disk into an image file is fast and easy using the Atola Forensic Imager. Just select a storage location on the host PC or media and specify the image file size (put all data in 1 image file or “chunk” the data into a series of smaller files).