How we built DiskSense 2 for Atola Insight Forensic
My last months were dedicated to pre-release work on the new Atola hardware. We made it happen 10 days ago. And now I want to reflect on how we got to the product launch.
Why DiskSense 2
Atola Technology has a compact team of two dozen. Being aware of our capacity, we have always been quite deliberate about developing our business strategy. Therefore, as we were contemplating our further development priorities, we asked ourselves these questions:
- Should we create a new product?
- Since Atola TaskForce is in such high demand, should we focus solely on developing this product and upgrading its platform?
Those questions induced great discussions within the team because the answer would clearly have a huge impact on the destiny of the company.
Looking back, Atola Insight Forensic with DiskSense unit was launched in 2014. It quickly sold to customers around the globe and has been in popular demand since then. Our sales didn’t even drop during the pandemic-ridden 2020. The feedback coming from our current customers and sales partners also became one of the key factors.
As a result, we decided to reinvent DiskSense unit, turning Atola Insight Forensic into a modern imaging solution with hardware adequate to the demands of 2021. The new generation called DiskSense 2 is based on a server-grade motherboard, with ECC RAM and allowing 3 drives being imaged in parallel.
The secret of change is to focus all of your energy, not on fighting the old, but on building the new.
© Socrates
Pains and Gains
There are many people worldwide who have been using Atola Insight Forensic in the years spanning from its launch in 2014. Therefore the development of the new hardware unit became more focused and specific. As we were starting this work, we already knew both most common issues with the unit (pains) and potential features that could bring about a positive impact (gains). Here I’d like to shed some light on the most essential of them.
Pain 1. Connectivity
The most frequent tech support question for the previous DiskSense unit was:
I cannot connect to this unit. What do I do next?
The old unit had a set of preinstalled static IP addresses: 10.0.0.188, 192.168.0.188. It turned out to be a less than optimal solution. We were keen to make it more convenient to start using the new system. DiskSense 2 unit has two 10 Gbit Ethernet ports. By design, they enable two types of preinstalled networking setup:
- ETH1 port —for static IP connection
- ETH2 port— for dynamic IP connection via network router
On top of that, we equipped the unit with an IP display to show the current unit’s IP address.
Pain 2. Native NVMe drive support
NVMe technology continues to grow and its penetration into computer systems is expanding. No surprisingly, it causes the share of NVMe drives involved in DFIR cases to grow, too. Our previous DiskSense unit preceded the emergence and spread of NVMe drives. That’s why there are limitations to the way the old generation of DiskSense units could handle NVMe drives. The USB-to-NVMe adapter we recommended for such cases was just a workaround.
DiskSense 2 unit relieves this pain. It introduces native low-level I/O with NVMe drives, which improves damaged drive support. The imaging speed has significantly increased, too.
Gain 1. Imaging throughput
These days, our customers encounter cases with dozens of drives involved in them. Perhaps, the largest one I heard of included 80 drives. It is crazy!
The previous unit allowed a single imaging session. It is particularly troublesome when you have a damaged source drive. Yes, Atola Insight will automatically handle it for you. But depending on the degree of the damage, the job can take several days. You end up with a forensic imager that is fully busy with a single job for an extensive period of time.
It prompted us to design DiskSense 2 device, which would enable imaging of 3 source drives simultaneously. It increased the total imaging throughput to 4 TB per hour. Furthermore, the new unit easily copes with imaging of three damaged drives at a time!
Gain 2. Server-grade hardware in a small box
Here is a joy-delivering combo:
- Xeon CPU+ Supermicro motherboard + ECC RAM + Atola PCBs
Our team smartly packed it in a box with the width and depth of a modern MacMini! I am very grateful to Atola hardware team that came up with the multi-layered design to make the compact size possible.
One of the most ingenious ideas was making IDE port an external one. It helped keep DiskSense 2 unit dimensions to the minimum. To work with IDE drives, we created a new proprietary adapter.
What’s next
Eventually, we launched the DiskSense 2 unit on July 5, 2021. It‘s good to see and feel the excited reaction in the industry and the forensic community. It’s a challenge to cope with high pre-sales demand and the initial sales rounds. Although these are the kind of problems I prefer to have :)
Even though we normally keep the product roadmap to ourselves, I can share that the team has been working on Atola Insight Forensic 5.1 for two months now. It will include lots of improvements and one unexpected innovative feature. More news will follow shortly! Just stay tuned to Atola social media:
Sincerely,
Vitaliy Mokosiy
