Atola Forensic Imager

Frequently Asked Questions

Click questions to expand text

Common Questions

• Can the Atola Forensic Imager software program be purchased without the DiskSense hardware unit?
  No, the Atola Forensic Imager software cannot be purchased without a DiskSense unit. Atola Forensic Imager fully depends on the DiskSense unit functionality.
• What are the PC requirements for each of the Atola DiskSense Ethernet unit?
  The DiskSense Ethernet unit requires an Ethernet port. Any speed is compatible (10/100/1000 Mbit), however, when creating images over a network, a Gigabit link (1000 Mbit) is highly recommended.

  Atola Forensic Imager software requires a Windows operating system. More details are available in the Atola Insight Manual.

• What are the hardware and operating system requirements for running the Atola Forensic Imager?
  Hardware and software requirements are available in the Atola Insight Manual.
• How much variation is there in data transfer speed during imaging?
  Data transfer speed depends largely on the hard drive. The DiskSense Ethernet can reach speeds up to 110 MB/sec (6.6 GB per minute), but the speed may be as slow as 50 MB/sec (3 GB per minute) when working with older or slower HDD models.
• How can I achieve the best duplication speed with DiskSense Ethernet unit?
  To have an acceptable throughput you would need to use a Gigabit Ethernet network card in your computer. If you plug DiskSense unit into a network switch, the switch has to be rated for Gigabit speeds (as well as all other intermediate switches between the unit and PC where Atola Forensic Imager software is installed). Gigabit Ethernet will give you the maximum speed of about 85 Mb/s.

  When Gigabit Ethernet is not available, the maximum speed would be only 8 MB/s which is very low.

  There are few steps to ensure high speed connection:

  1. Check that your Ethernet adapter supports Gigabit Ethernet. If it doesn't, then you would have to obtain a new Ethernet adapter that supports Gigabit Ethernet.
  2. If DiskSense is not directly attached to the PC but to a networking switch, then please make sure that it does support Gigabit Ethernet (as well as all other intermediate switches, if any). Ethernet adapter in the PC still must support Gigabit Ethernet.
  3. A misconfigured network switch or network adapter can cause a negative impact on the speed as well.
  4. Verify that all intermediate network cables between the unit and the PC are 5e category or higher (cat. 6). It is suggested the cables should not be too long; however, usually long cables (20 meters/60 feet and more) do not cause any issues.
  5. For maximum performance, DiskSense Ethernet unit should be connected directly to the Ethernet adapter on the PC without any intermediate network switches.

  There are other things that could affect transfer speeds like network adapter drivers, motherboard drivers, antivirus software and so on. However, complying with the rules above is enough for most cases.

  To verify the network speed you can do the following:

  1. Launch the Atola Forensic Imager software
  2. Connect a good and fast hard drive to the Source port of the DiskSense unit
  3. Navigate to Imaging, select Imaging to File option
  4. In the file selection dialog enter file name nul (with one L if you are using Atola Forensic Imager version 2.0 or earlier; if you are using version 2.1 or newer, the name should be null with two L). This special file name will force Imager to skip writing, thus target write speed will not affect the measurement. Data is still transferred through Ethernet.
  5. Begin imaging

  If everything is working properly, you should see speeds of 50 MB/s or higher.

Case Management

• When a case is being continued, how can I tell which technician worked on the hard drive?
  In situations where different technicians are working on a single case, we recommend adding a note in the case history of who worked on each phase. In future versions of Atola Insight, the note will be added automatically.
• Can the user add notes to the case history after a case is closed?
  Yes. This can be done quickly and easily by opening the case history and clicking "Add note".
• Can 2 hard drives share 1 case number if they are related (example: 2 hard drives from an array)?
  Not at this time. Each case number can only be dedicated to a single hard drive. However, a note can be made in each case history explaining any connection to other cases. For example, “this hard drive is from the same array as case 8XB9906” or, “customer name: Jesse Foox.” This would allow the user to run a key word search to examine similarities between cases.