{"id":6320,"date":"2022-02-09T14:21:46","date_gmt":"2022-02-09T12:21:46","guid":{"rendered":"https:\/\/blog.atola.com\/?p=6320"},"modified":"2023-01-16T12:20:40","modified_gmt":"2023-01-16T10:20:40","slug":"image-anything-fast-taskforce-the-ultimate-forensic-imager","status":"publish","type":"post","link":"https:\/\/atola.com\/blog\/image-anything-fast-taskforce-the-ultimate-forensic-imager\/","title":{"rendered":"Image. Anything. Fast. What makes TaskForce the ultimate forensic imager"},"content":{"rendered":"

Atola\u2019s high-performance TaskForce forensic imager<\/a> has a well-developed imaging functionality that performs a huge variety of acquisition-related jobs. Not only does it assemble, identify RAID configuration and image RAID arrays. TaskForce also safely handles damaged evidence drives, verifies data on good and bad media, performs selective imaging, has a special zero-click imaging mode on its 17 source ports, etc.\u00a0<\/span><\/p>\r\n

In this blog, we will touch on all of these and other imaging options that make TaskForce an imager that exceeds your expectations.<\/span><\/p>\r\n

Optimize your performance\u00a0<\/b><\/h3>\r\n

TaskForce is equipped with a variety of time-saving features that boost your productivity, making your work with evidence drives simple and effective.<\/span><\/p>\r\n

With its 18 configurable ports <\/a><\/span>and <\/span>uniquely capable and flexible hardware,<\/span><\/a> Atola TaskForce has the fastest <\/span>and most capable imaging engine in the forensic market allowing it to achieve up to<\/span> 15 TB\/h of imaging performance<\/a><\/b>. What\u2019s more, thanks to its web-based interface, multiple users<\/a> can be imaging their devices at the same time, making this imager ideal for forensic labs with a team working on their assignments in parallel.<\/span><\/p>\r\n

Express mode<\/b> is a special way of using TaskForce. When in <\/span>Express mode<\/span><\/a>, every imaging session starts automatically the moment a drive is plugged into a source port.\u00a0<\/span> Express mode is preconfigured in the settings: enable source drive diagnostics, imaging to a folder on a server or a NAS, saving reports to the same folder. These and other settings help you streamline your acquisition process and waste zero clicks on each imaging session.<\/span><\/p>\r\n

\"\"<\/p>\r\n

Express mode activated. 17 imaging sessions started with 0 clicks<\/strong><\/p>\r\n

Of TaskForce\u2019s 18 ports, 17 can be used in Express mode (all except the Extension port). Meanwhile, all ports set to target mode are left available for other tasks.<\/span><\/p>\r\n

Connect TaskForce to your workflow via Web API<\/b><\/h3>\r\n

TaskForce supports <\/span>Web API<\/span><\/a> to further optimize your work with evidence if you are using a <\/span>workflow automation<\/b> tool like <\/span>Magnet Automate<\/span><\/a>, <\/span>OrcheSight<\/span> platform<\/span><\/a> or an in-house solution the likes of which have been developed by our customers.<\/span><\/p>\r\n

The automated workflows help you avoid manual work and idle times between different stages of evidence processing. Another way to save time and focus on other tasks!\u00a0<\/span><\/p>\r\n\r\n

try { \r\n    $r = Invoke-WebRequest \"http:\/\/10.0.0.65\/api\/start-image?source=SATA4&targetFolder=\\\\Vitaliy\\Share\"\r\n} \r\ncatch {\r\n    Write-Output \"$($_.Exception.Message)\"\r\n    exit $_.Exception.Response.StatusCode\r\n}\r\n\r\n$taskKey = $r.Content\r\ndo {\r\n    $check = (Invoke-WebRequest \"http:\/\/10.0.0.65\/api\/check-task?taskKey=$taskKey\").Content | ConvertFrom-Json\r\n    Start-Sleep -s 1\r\n} while ($check.state -eq \"progress\")\r\n\r\n$windowsPath = \"C:\\Share\\\" + ($check.target -replace '[\\\/]', '\\' | Split-Path -leaf) \r\n$caseName = \"Case123\"\r\n$autopsyArguments = '--inputPath=\"' + $windowsPath + '\" --caseName=' + $caseName + ' --runFromCommandLine=true'\r\nStart-Process -FilePath \"C:\\Program Files\\Autopsy-4.11.0\\bin\\autopsy64.exe\" -ArgumentList $autopsyArguments<\/pre>\r\n
RAID recognition, reassembly and imaging<\/b>\u00a0<\/span><\/h3>\r\n
TaskForce is the only <\/span>hardware RAID imager<\/span><\/a> in the world. You can use TaskForce to <\/span>assemble drives and\/or image files into RAID arrays, automatically detect their configuration<\/strong> and image the arrays or their volumes in a forensically sound manner.<\/span>\u00a0<\/b> \u00a0<\/p>\r\n
We continue delivering improvements into the RAID module with every new TaskForce firmware update. At the moment, it supports:<\/span><\/p>\r\n