API docs by Redocly

Atola TaskForce Web API (2026.2.0)

Download OpenAPI specification:Download

TaskForce API is based on HTTP GET requests and JSON-encoded responses.

Get available Source drives

It finds drives plugged into Source ports (i. e. the ports that are currently switched to Source mode) that are not busy by other running tasks. It automatically powers up all non-powered Source devices.

The request returns the number of available scannedSourcePorts and that of totalSourcePorts. If scannedSourcePorts equals to totalSourcePorts, it means TaskForce powered up and checked all currently available Source ports for devices.

Max number of Source ports:

  • 26 for TaskForce 2
  • 18 for TaskForce 1

Turn on the Source switch to activate Source mode for that port.

query Parameters
token
string

User access token provided by the /login endpoint. Required when User Management is enabled in UI settings.

Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478

Responses

Response samples

Content type
application/json
{
  • "scannedSourcePorts": 9,
  • "totalSourcePorts": 13,
  • "foundSourceDevices": [
    ]
}

Get port status

It powers on the specified port and identies the connected drive. If the state is identifying, the drive detection is still in progress. Continue polling this endpoint until the state changes to either ready or not-detected.

Examples:

  • http://TASKFORCE_IP/api/scan-port?sas8
  • http://TASKFORCE_IP/api/scan-port?EXT1
Returns JSON object: { state, isSource, model, serial, caseId, evidenceId }
  • state - task-progress, ready, identifying or not-detected
  • isSource - true or false
  • model - device model (empty if device is identifying or not detected)
  • serial - device serial (empty if device is identifying or not detected)
  • caseId - case identifier
  • evidenceId - evidence identifier from case
query Parameters
<portId>
required
string

Port identifier, consists of port type and number. Case insensitive.

Example:

  • sata3
  • IDE1

Acceptable port names are SATA1, SATA2, SATA3, SATA4, SATA5, SATA6, SAS1, SAS2, SAS3, SAS4, SAS5, SAS6, USB1, USB2, USB3, USB4, IDE1, EXT1
and, for TaskForce 2 only: SATA7, SATA8, SAS7, SAS8, NVME1, NVME2, NVME3, NVME4.

token
string

User access token provided by the /login endpoint. Required when User Management is enabled in UI settings.

Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478

Responses

Response samples

Content type
application/json
{
  • "state": "task-progress",
  • "isSource": true,
  • "model": "SanDisk SDSSDA120G",
  • "serial": "171431421695",
  • "caseId": "CaseABC123",
  • "evidenceId": "dev777"
}

Start imaging

Launches imaging from a source drive plugged into the specified Source port into a the specified network target folder. By default, target image is a compressed E01 but the file format can be changed in the parameters.

Two mandatory parameters: source and targetFolder. Other parameters have default values, which can be adjusted.

Examples:

  • http://TASKFORCE_IP/api/start-image?source=SATA4&targetFolder=//Server/Share
  • http://TASKFORCE_IP/api/start-image?source=SATA4 SDSSDA120G Z32081RL&targetFolder=//10.0.0.14/Share
query Parameters
source
required
string

Source identifier. It can be specified in two ways: 1) Source port; 2) Source port, drive model and serial

Examples:

  • Source port: SATA4
  • Source port, drive model and serial: SATA4 SanDisk SDSSDA120G 171108456213

Acceptable port names are SATA1, SATA2, SATA3, SATA4, SATA5, SATA6, SAS1, SAS2, SAS3, SAS4, SAS5, SAS6, USB1, USB2, USB3, USB4, IDE1, EXT1
and, for TaskForce 2 only: SATA7, SATA8, SAS7, SAS8, NVME1, NVME2, NVME3, NVME4.

targetFolder
required
string

Network folder path where target image is created. Supports Linux and Windows formats of path separators (slashes, backslashes).

Examples:

  • //10.0.0.14/Share
  • //MyServer/Shared-folder
targetFile
string

Target image file name without extension. If you don`t specify this parameter, target file name will be genereted from source disk model and serial.

settings
string

Name of the customized imaging settings. Customized settings can be created and renamed on the imaging start page (after you select the source and the target(s) in UI).

Default value: Default

targetType
string

Type of target image file. In can be either e01, aff4 or raw.

Default value: e01

saveReport
boolean

Save report in the target folder alongside with created image file.

Default value: yes

targetFolderLogin
string

Username or login. Used when targetFolder points to a password-protected network path.

Empty by default.

targetFolderPwd
string

Password. Used when targetFolder points to a password-protected network path.

Empty by default.

targetFolderDomain
string

Network domain. Used when targetFolder points to a password-protected network path.

Empty by default.

mountOptions
string

Mount option for experienced users. Used when targetFolder points to a network path which requires custom mount options.

Empty by default.

dnsLookup
string

TaskForce 2 only option.

Specifies the method for resolving the remote server hostname.

Acceptable values:

  • taskforce - Uses the firmware's hostname resolution logic (default behavior)
  • cifs - Uses the mount.cifs hostname resolution logic
e01Case
string

Case ID written to E01 image file metadata.

Empty by default.

e01Evid
string

Evidence number written to E01 image file metadata.

Empty by default.

e01Desc
string

Description written to E01 image file metadata.

Empty by default.

e01Inv
string

Examiner/investigator name written to E01 image file metadata.

Empty by default.

e01Comp
boolean

Indicates whether E01 target image is compressed.

Default value: yes

e01Segment
number

Specify segment size for E01 file in GB. Minimal segment size is 1GB.

Default value: 0 (It means TaskForce will create one E01 file)

aff4Case
string

Case ID written to Aff4 image file metadata.

Empty by default.

aff4Evid
string

Evidence number written to Aff4 image file metadata.

Empty by default.

aff4Inv
string

Examiner/investigator name written to Aff4 image file metadata.

Empty by default.

aff4Comp
string

Specify Aff4 image file compression type.

Available options: lz4, snappy, not compressed

Default value: not compressed

aff4Hash
string

Specify Aff4 image file hash type.

Available options: md5, sha1, md5+sha1, sha256, sha512

Default value: md5+sha1

token
string

User access token provided by the /login endpoint. Required when User Management is enabled in UI settings.

Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478

Responses

Response samples

Content type
text/plain
image_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223

Start logical imaging

Launches logical imaging from a source drive plugged into the specified Source port into a the specified network target folder. By default, target image is a compressed L01 but the file format can be changed in the parameters.

Two mandatory parameters: source and targetFolder. Other parameters have default values, which can be adjusted.

Examples:

  • http://TASKFORCE_IP/api/start-logical?source=SATA4&targetFolder=//Server/Share
  • http://TASKFORCE_IP/api/start-logical?source=SATA4 SDSSDA120G Z32081RL&targetFolder=//10.0.0.14/Share
query Parameters
source
required
string

Source identifier. It can be specified in two ways: 1) Source port; 2) Source port, drive model and serial

Examples:

  • Source port: SATA4
  • Source port, drive model and serial: SATA4 SanDisk SDSSDA120G 171108456213

Acceptable port names are SATA1, SATA2, SATA3, SATA4, SATA5, SATA6, SAS1, SAS2, SAS3, SAS4, SAS5, SAS6, USB1, USB2, USB3, USB4, IDE1, EXT1
and, for TaskForce 2 only: SATA7, SATA8, SAS7, SAS8, NVME1, NVME2, NVME3, NVME4.

targetFolder
required
string

Network folder path where target image is created. Supports Linux and Windows formats of path separators (slashes, backslashes).

Examples:

  • //10.0.0.14/Share
  • //MyServer/Shared-folder
targetFile
string

Target image file name without extension. If you don`t specify this parameter, target file name will be genereted from source disk model and serial.

settings
string

Name of the logical imaging settings with filters. Customized settings can be created and save on the logical imaging start page. Use 3-dot button in the bottom right corner and "Save to" option.

Default value: Default

targetType
string

Type of target image file. In can be either L01 or zip.

Default value: L01

saveReport
boolean

Save report in the target folder alongside with created image file.

Default value: yes

targetFolderLogin
string

Username or login. Used when targetFolder points to a password-protected network path.

Empty by default.

targetFolderPwd
string

Password. Used when targetFolder points to a password-protected network path.

Empty by default.

targetFolderDomain
string

Network domain. Used when targetFolder points to a password-protected network path.

Empty by default.

mountOptions
string

Mount option for experienced users. Used when targetFolder points to a network path which requires custom mount options.

Empty by default.

dnsLookup
string

TaskForce 2 only option.

Specifies the method for resolving the remote server hostname.

Acceptable values:

  • taskforce - Uses the firmware's hostname resolution logic (default behavior)
  • cifs - Uses the mount.cifs hostname resolution logic
l01Case
string

Case ID written to L01 image file metadata.

Empty by default.

l01Evid
string

Evidence number written to L01 image file metadata.

Empty by default.

l01Desc
string

Description written to L01 image file metadata.

Empty by default.

l01Inv
string

Examiner/investigator name written to L01 image file metadata.

Empty by default.

compression
boolean

Indicates whether target image is compressed.

Default value: yes

hash
string

Specifies whether each file inside L01 image should include its hash. Available options: md5, sha1, md5+sha1, none

Default value: md5+sha1

token
string

User access token provided by the /login endpoint. Required when User Management is enabled in UI settings.

Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478

Responses

Response samples

Content type
text/plain
logical_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223

Diagnose drive

Launches diagnostics of a drive. The diagnostics can be performed for drives in both modes: Source and Target.

One mandatory parameter: source. Other parameters have default values, that can be adjusted.

Examples:

  • http://TASKFORCE_IP/api/diagnose?source=SATA4
  • http://TASKFORCE_IP/api/diagnose?source=SATA4 SDSSDA120G Z32081RL
query Parameters
source
required
string

Identifier of the drive in Source or Target mode. It can be specified in two ways: 1) Drive port; 2) Drive port, drive model and serial

Examples:

  • Drive port: SATA4
  • Drive port, drive model and serial: SATA4 SanDisk SDSSDA120G 171108456213

Acceptable port names are SATA1, SATA2, SATA3, SATA4, SATA5, SATA6, SAS1, SAS2, SAS3, SAS4, SAS5, SAS6, USB1, USB2, USB3, USB4, IDE1, EXT1
and, for TaskForce 2 only: SATA7, SATA8, SAS7, SAS8, NVME1, NVME2, NVME3, NVME4.

reportFolder
string

Network folder path where diagnostic report copy will be saved. Supports Linux and Windows formats of path separators (slashes, backslashes).

Empty by default.

Examples:

  • //10.0.0.14/Share
  • //MyServer/Shared-folder
reportFolderLogin
string

Username or login. Used when reportFolder points to a password-protected network path.

Empty by default.

reportFolderPwd
string

Password. Used when reportFolder points to a password-protected network path.

Empty by default.

reportFolderDomain
string

Network domain. Used when reportFolder points to a password-protected network path.

Empty by default.

mountOptions
string

Mount option for experienced users. Used when reportFolder points to a network path which requires custom mount options.

Empty by default.

dnsLookup
string

TaskForce 2 only option.

Specifies the method for resolving the remote server hostname.

Acceptable values:

  • taskforce - Uses the firmware's hostname resolution logic (default behavior)
  • cifs - Uses the mount.cifs hostname resolution logic
token
string

User access token provided by the /login endpoint. Required when User Management is enabled in UI settings.

Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478

Responses

Response samples

Content type
text/plain
diagnose_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223

Check task status

Gets data about the progress of running or completed tasks. Requires taskKey or source parameter:

  • taskKey value is generated in response to /start-image, /start-logical or /diagnose request.
  • source value can be specified in two ways: 1) Source port; 2) Source port, drive model and serial.

Example:

  • http://TASKFORCE_IP/api/check-task?taskKey=image_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223
  • http://TASKFORCE_IP/api/check-task?source=SATA5

Returns JSON object: { task, taskStep, source, port, state, message, progress, completionDate, target, report, hashes }

  • state - completed, failed, progress, paused, completed-warning, stopped or initial
  • task - name of the task. Example: image
  • taskStep - a stage of the task. For imaging it can be: pre-hash, image, post-hash. For diagnostics possible stages are: Circuit board, File system, Firmware, Heads and Media scan.
  • source - source device model and serial
  • port - unit port where a device was plugged in. Example: SATA 3
  • progress - shown in percents. If state=failed, then progress=-1
  • message - additional information
  • completionDate - completion date and time of the task
  • target - file path to the network target image
  • report - file path to the network task report
  • hashes - one or two image hashes calculated during imaging

query Parameters
taskKey
string

Task identifier. It is generated in response to /start-image request. Either this parameter or source must be specified.

Example:

  • image_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223
source
string

Source identifier. It can be specified in two ways: 1) Source port; 2) Source port, drive model and serial. Either this parameter or taskKey must be specified.

Examples:

  • Source port: SATA4
  • Source port, drive model and serial: SATA4 SanDisk SDSSDA120G 171108456213

Acceptable port names are SATA1, SATA2, SATA3, SATA4, SATA5, SATA6, SAS1, SAS2, SAS3, SAS4, SAS5, SAS6, USB1, USB2, USB3, USB4, IDE1, EXT1
and, for TaskForce 2 only: SATA7, SATA8, SAS7, SAS8, NVME1, NVME2, NVME3, NVME4.

token
string

User access token provided by the /login endpoint. Required when User Management is enabled in UI settings.

Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478

Responses

Response samples

Content type
application/json
{
  • "state": "completed",
  • "source": "SanDisk SDSSDA120G 171108456213",
  • "port": "SATA 4",
  • "task": "image",
  • "taskStep": "post-hash",
  • "message": "completed",
  • "completionDate": "2021-12-30 13:30",
  • "progress": "100",
  • "target": "//Server/share/SanDisk SDSSDA120G171108456213_0.E01",
  • "report": "//Server/share/SanDisk SDSSDA120G171108456213_0_E01_report/Report.html",
  • "hashes": {
    }
}

Stop running task

Running this request pauses active task or stop it (for tasks that can not be paused). Corresponding task report will be created. Paused task can be restarted in TaskForce user interface.

taskKey is a mandatory parameter, whose value is generated in response to /start-image, /start-logical or /diagnose request.

Example:

  • http://TASKFORCE_IP/api/stop-task?taskKey=image_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223
query Parameters
taskKey
required
string

Task identifier. It is generated in response to /start-image, /start-logical or /diagnose request.

Example:

  • image_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223
token
string

User access token provided by the /login endpoint. Required when User Management is enabled in UI settings.

Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478

Responses

Create case

Creates a new case for a drive and associates it with the provided case details. Use this endpoint to start tracking a new forensic case for a specific drive.

The drive must be identified and powered on at one of the available ports before calling this endpoint. The drive cannot be busy with another running task.

Specifying source or pair of model + serial is mandatory to identify the drive.

Examples:

  • http://TASKFORCE_IP/api/create-case?source=SATA4%20SanDisk%20SDSSDA120G%20171108456213&caseId=CASE-001&caseDescription=Evidence%20from%20suspect%20laptop
  • http://TASKFORCE_IP/api/create-case?model=SDSSDA120G&serial=171108456213&caseId=CASE-001&evidenceId=EV-001
query Parameters
source
required
string

Drive identifier in a format retrievable from /scan-devices request. Drive must be identified and powered on respective port.

Examples:

  • Source port, drive model and serial: SATA4 SanDisk SDSSDA120G 171108456213

model
required
string

Model of the drive. It can be retrieved using the /scan-port request endpoint.

  • Must be provided alongside the serial parameter.
serial
required
string

Serial number of the drive. It can be retrieved using the /scan-port request endpoint.

  • Must be provided alongside the model parameter.
caseId
string

If provided, Case ID field will be assigned to this value. It must be unique within the system if TaskForce setting ‘Allow non-unique case names’ is disabled.

caseExaminer
string

If provided, Case examiner field will be assigned to this value.

caseDescription
string

If provided, Case description field will be assigned to this value.

caseLocation
string

If provided, Case location field will be assigned to this value.

caseOrganization
string

If provided, Case organization field will be assigned to this value.

evidenceId
string

The identifier used to link the drive to a case. If provided, Evidence ID field will be assigned to this value.

evidenceExaminer
string

If provided, Evidence examiner field will be assigned to this value .

token
string

User access token provided by the /login endpoint. Required when User Management is enabled in UI settings.

Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478

Responses

Edit case

Updates the details of an existing case. Use this endpoint to modify case information such as description, examiner, location, or organization for a previously created case.

The case must be associated with the specified caseId. If no matching case is found, the request will fail with an error.

Examples:

  • http://TASKFORCE_IP/api/edit-case?caseId=CASE-001&caseDescription=Updated%20description&caseExaminer=John%20Smith
query Parameters
caseId
required
string

The identifier used to locate the case to update.

  • If one or more matching cases are found, the most recently used case will be selected for details update.
  • If no matching case is found, the request will fail with an error.
caseExaminer
string

The new name or ID to be assigned as the case examiner. If provided, this value will overwrite the existing examiner field for the case.

caseDescription
string

The new text value to assign as the case description. If provided, this value will overwrite the existing description field for the case.

caseLocation
string

The new text value to assign as the case location. If provided, this value will overwrite the existing location field for the case.

caseOrganization
string

The new text value to assign as the case organization. If provided, this value will overwrite the existing organization field for the case.

evidenceId
string

The identifier used to locate evidence in the case to update the evidence examiner name. The new evidence examiner name must be specified by evidenceExaminer.

The new evidence examiner value will be assigned to all evidence drives that match this identifier.

evidenceExaminer
string

The new name for the evidence examiner which is defined by the specified evidenceId

token
string

User access token provided by the /login endpoint. Required when User Management is enabled in UI settings.

Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478

Responses

Download report

Downloads a report for a task.

HTTP response is as follows:

For /start-image and /start-logical tasks, a text/plain with a ZIP file containing all report files and logs is attached in the Content Disposition header.

For /diagnose task, a text/plain with an HTML report file is attached in the Content Disposition header.

The taskKey is a mandatory parameter. Its value is generated in response to a /start-image, /start-logical, or /diagnose request.

Example:

  • http://TASKFORCE_IP/api/report?taskKey=image_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223
query Parameters
taskKey
required
string

Task identifier. It is generated in response to /start-image, /start-logical or /diagnose request.

Example:

  • image_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223
token
string

User access token provided by the /login endpoint. Required when User Management is enabled in UI settings.

Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478

Responses

Response samples

Content type
text/plain
Example
Content-Disposition: "attachment; filename=taskKey.html"

Login as user

Validates user credentials from HTTP request body. If valid and associated with an existing user, it will issue an access token.

Note: User management must be activated in UI settings.

Example:

  • http://TASKFORCE_IP//login
Request Body schema: application/json
required
username
required
string

Name of existing TaskForce user.

password
required
string

Password of the user.

Responses

Request samples

Content type
application/json
{
  • "username": "admin",
  • "password": 12345
}

Response samples

Content type
text/plain
9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478

Show API documentation

Opens this API documentation page.

Responses