Atola TaskForce

The latest firmware version includes imaging file on target, imaging to E01 compressed file, storing cawse data on a server and other great features!

Atola TaskForce has a complex imaging functionality, which allows imaging even physically damaged drives, while avoiding further drive deterioration. Damaged media require a sophisticated imaging approach to balance out thorough data extraction with forensics’ need in expediency and careful treatment of damaged media.

When the target drive is larger than the source evidence drive, the target hash will not be identical to the hash of the source. To avoid this, you can limit the drive space by enabling HPA to a SATA target.

Create a new E01 file, to which you will image your evidence and select both MD5 and SHA1 hashes to be calculated in the course of imaging.

SMART table is a valuable source of information about a hard drive’s health. SMART (Self-Monitoring, Analysis and Reporting Technology) provides stats of a drive’s operation, thus helping predict its future failure.

In TaskForce, Jumbo frames are activated by default to ensure maximum data transfer rates when imaging to a file on your server.

Atola TaskForce’s case management system allows you to print out all reports concerning your evidence, whether it is about dignosing, imaging, calculating hash or any other action.

This video explains how to image an NVMe drive to a file on your local network with Atola TaskForce. The image file is located on a local network. For more information about network setup and configurations, please follow this guide. NVMe imaging is possible with Atola M.2 SSD adapter.  

Thunderbolt extension enables TaskForce to operate on all MacBooks with these interfaces: FireWire, Thunderbolt 2 and Thunderbolt 3 (2016 – 2017 models). There is no need to remove the SSD, Thunderbolt extension allows connecting the whole Apple laptop to TaskForce.  Moreover, it is possible to work with all the recent Read more…

Some source evidence drives and their images can be involved in a long-running investigation case and wait to be presented in court for months or years on end. Data stored on such drives and their image files may eventually get corrupt. Therefore it may be critical for an investigator to Read more…