Revolutionizing Forensic Acquisitions: ATRIO 1.2.3 Unleashes Speed and Simplicity for Onsite Investigations

One of the most important factors in-field forensic acquisitions are speed and integrity. An investigator needs to be able to quickly acquire the evidence on site and be confident that the acquisitions are a true carbon copy of the devices. Currently the forensic workflow forces an examiner to image devices to external hard drives and then re-hash the evidence once they load the files onto their forensic workstation. This practice adds a level of complication and time to an already time sensitive task. Here at ArcPoint Forensics, we found a new solution that will not only save time but simplify the entire process for any examiner. Starting with software version 1.2.3, ATRIO can now quickly and securely acquire E01s directly to the internal 8TB drive. This new feature gives the examiner greater flexibility in deploying ATRIO to onsite jobs, with the ability to create and securely store forensic images of multiple devices.

In addition, ATRIO is able to re-verify the image to ensure integrity during the acquisition or during the image export process. This can be done by simply pressing the “VERIFY INTERNAL E01” or the “VERIFY EXPORTED EO1” option under the Image Only submenu. Once exported, the results will contain the actual E01 image, the Image Creation report, and finally the Hash Verification report.

The export function is extremely easy and quick  to use and can be initiated by connecting a destination drive and simply pressing the “EXPORT STORED EO1” option under the Image Only submenu. ATRIO will export all stored E01s and any associated reports. The export progress will be displayed on the front LCD screen, once finished the green GO button will illuminate and the destination drive will be safe to disconnect. To delete any stored E01s on the ATRIO, the “ERASE STORED E01” option can be selected. This option will securely erase any stored evidence file from ATRIO’s internal store, this option might take some time depending on how many files are stored due to its secure erase function.

Here at ArcPoint forensics, we understand the need for secure and speedy acquisitions during an investigation.  ATRIO’s new internal E01 feature enables an investigator to safely save any E01 acquisition directly to ATRIO, bypassing the need to carry additional storage devices and worrying about the integrity of the collected evidence at the collection site. ATRIO can save the E01s directly to its own encrypted 8TB drive and provide detailed verification reports to the examiner during acquisition or during the export process. This feature is just one of many features that enables ATRIO to become a force multiplier in the forensic landscape.