FF: Yulia, please tell us about your background, how you got into digital forensics and your role at Atola.
Yulia: I joined Atola in 2016, and it was the technology that first drew my attention. I was still fresh to the IT world at the time, having worked for environmental companies for over a decade. It was surprising to cross paths with a company working in such an innovative and niche, yet an extremely impactful industry, I feel very lucky.
Initially, I was invited to join Atola as a technical writer and was soon promoted to Director of Marketing. In this role, my primary goals are, first and foremost, to ensure that our products meet our customers’ needs and evolve with these needs, and secondly, train our customers to use our imagers in ways that achieve the best results. Third, I want to spread the word about Atola imagers to investigators who need our solutions.
You are a frequent visitor of DFIR events. In this perspective, 2020 with COVID had a serious impact by canceling or virtualizing all of them. Right now, at the end of 2022, can we say that conferences have recovered?
You and I both know very well how sensitive DFIR professionals are when it comes to sharing information and establishing new connections. Therefore face-to-face meetings are essential for investigators to exchange knowledge, while for vendors it is necessary to hear about their users’ experiences and needs, and to inform them about the new solutions being developed.
I vividly remember the return of offline events in the summer of 2021 and how thrilled we all were that it was finally happening! 2022 brought many more events and we were seeing growing numbers of attendees as the year progressed, so the conferences are on their way to recovery. I’m looking forward to 2023 and all the meetings it will bring. I hope that forensic units will be investing in their colleagues visiting conferences for education and communication that is so beneficial to all!
Thankfully, throughout our forced online time in 2020-2021 and continuing today, Forensic Focus remains one of very few platforms that is a reliable source of information and your role in keeping the community informed is so very much appreciated.
What is the biggest value of Atola products according to the feedback you receive from digital forensic experts?
Two themes that we have been hearing throughout the years are high performance and tough cases. The former is obviously a tribute to the extreme high capacity of our imagers: Insight, for instance, can image 3 SSD drives in parallel, at 500 MB/sec each, while TaskForce achieves a whopping 15 TB/hour of cumulative imaging speed by imaging 12+ drives simultaneously. TaskForce is even equipped with a multi-launch feature to start the same operation on multiple devices and Express mode for instant, zero-click imaging to a predefined folder of any devices you connect to it. Another productivity-oriented capability is integration with workflow automation tools like Magnet AUTOMATE. In fact, TaskForce remains the only hardware imager that can be integrated with such tools.
As for the tough cases, our imagers are well known for their ability to overcome imaging issues on damaged drives including those with scratches on platters or bad heads (even some of the dropped ones or those that have been in a fire!). Other tough cases include RAIDs with an unknown configuration that our TaskForce can automatically detect, reassemble and image. Insight, on the other hand, has a sector-level artifact finder that is able to give an extended output of results because it searches for evidence beyond the existing file structure.
By the way, what’s your favorite feature?
Oh, that is definitely the RAID functionality. Imagine how many hours of work it is saving for hundreds of examiners worldwide! Besides, this feature, from its inception to implementation, is a perfect example of Atola’s approach to development. It started with a key European customer looking at TaskForce and saying “I do not know any other hardware that would be capable of solving the RAID problem like this one potentially can.” Indeed, TaskForce with its 18 ports and server-grade hardware with exceptional computational capacity is uniquely suited to automate and expedite RAID configuration search, which manually could take hours or days. It is exactly what examiners had to deal with: receive a pile of drives that maybe used to be a RAID, with no clues even on the drive order, and thousands of possible configuration variants to try out!
These days, thanks to TaskForce, RAID reassembly process is automated and takes minutes, and the partition preview lets you triage and prioritize the contents. Thanks to the logical imaging module we introduced in April, RAID imaging can be full or partial, which again, saves a lot of time. Creating a feature that is so innovative, useful and absolutely unique was fascinating and challenging. And it is what we love to do as the world’s leading provider of forensic imaging solutions.
Recently, you have added new forensic capabilities to Atola TaskForce. Could you shed some light on that?
Our releases usually bring high-impact upgrades. In 2022 alone, we added substantial enhancements to our RAID module, supported two new wiping methods (SecureErase in April and Format NVM in November), introduced a user management system and a cross-relational case management system (where drives can belong to multiple cases and a case can contain multiple drives), added more API commands for different workflow automation scenarios, improved imaging performance, extended diagnostics on certain types of media, and added many more features.
Since its initial launch in 2020, the RAID module gets updated in every firmware release: support of new RAID types and file systems, tweaks to the configuration detection algorithms, etc. In the most recent firmware, we increased the degree of automation by adding an assumption that a RAID that has not been successfully reassembled may be missing a drive. This helps identify incomplete RAID 5 arrays.
I also like the way logical imaging is implemented in TaskForce: the smart filters, the easy manual selection and the performance of course! Users love it because it speeds up work with both large drives or RAIDs by acquiring only essential data.
You conduct offline & online training events in Atola. What have you learned from this experience so far? How much does it help your customers?
I hold both free workshops for existing customers and webinars for prospects and they are different to me. I enjoy the wow effect new prospects have when they see what our equipment is capable of. Such events help potential customers identify the right match among our products according to their use cases.
Yet I am also very interested in helping our current users extend their understanding of our imagers’ functionality. For example, in addition to the automated imaging algorithms and diagnostics modules in both of our products, Insight has more sophisticated data recovery features. They are helpful for the examiners who use Insight primarily for bad drives. Meanwhile, TaskForce users tend to ignore the manual, which is a tribute to TaskForce’s super intuitive interface. Still, they appreciate the improvements to their workflow that we suggest and the explanation of the magic behind all the automation. I like showing the hidden gems in TaskForce’s functionality, but most importantly, it is great to listen to people’s experiences with our imagers to better understand their needs.
These interactions are absolutely key for us when prioritizing our research and development plans. It is for this reason and also to address any technical questions, that one of our leading engineers joins me at the workshops. In 2022 it was our CTO Vitaliy Mokosiy who participated in almost all of these events, and according to Vitaliy, it was a very insightful activity for him too.
How do you see 2023 globally? What can we expect to see from Atola?
We live in a moment of global instability, but as a Ukrainian I am feeling very optimistic about 2023! I admire my fellow Ukrainians persevering and pushing back against Russia and I also want to praise my team who stay committed to further development of our technology. Our dedicated R&D team managed to release four major software updates in 2022, while colleagues at our Canadian HQ sold, built and shipped a record number of systems all while seamlessly supporting our worldwide customers in their critical work. It is thanks to daily efforts by people like them, our incredible fellow countrymen and women on the frontline and all of those supporting us around the globe that we will prevail.
In 2023, Atola will mark its 20 years in business. We will continue expanding our existing products’ functionality. Plus, we are working on an exciting new project, which we will announce here on Forensic Focus when the time comes!
What are your interests beyond the job? How do you spend your spare time?
Traveling, art and photography are among my hobbies, which I pursue with intermittent commitment and success. These days, I am settling in my new home in Frankfurt and focusing on expanding Atola’s activities in Europe and globally in the coming months.
