# Atola TaskForce Web API (2026.10.0) Download OpenAPI specification: [JSON reference]() TaskForce API is based on HTTP GET requests and JSON-encoded responses. ## Get available Source drives It finds drives plugged into Source ports (i. e. the ports that are currently switched to Source mode) that are not busy by other running tasks. It automatically powers up all non-powered Source devices. The request returns the number of available ` scannedSourcePorts ` and that of ` totalSourcePorts `. If ` scannedSourcePorts ` equals to ` totalSourcePorts `, it means TaskForce powered up and checked all currently available Source ports for devices. Max number of Source ports: - 26 for TaskForce 2 - 18 for TaskForce 1 Turn on the Source switch to activate Source mode for that port. ##### query Parameters | token | string User access token provided by the /login endpoint. Required when User Management is enabled in UI settings. Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478 | | --- | --- | ### Responses **200** OK **400** Bad request. Any unexpected error. Error message returned as HTTP message body. **401** Unauthorized. User access token is not valid. **408** Timeout. The request took too long. Make sure TaskForce and/or the device from which it is operated are connected to the network. get/scan-devices ### Response samples - 200 Content type application/json Copy Expand all Collapse all ` {"scannedSourcePorts": 9,"totalSourcePorts": 13,"foundSourceDevices": ["SATA4 SanDisk SDSSDA120G 171108456213","SATA2 Samsung SSD 840 PRO Series S1AXNSAF106001H","SATA5 ST500LM012 HN-M500MBB S2RWJ9CD415935","SAS1 DG0146BARTP HPD0 D0A2P9602JFL0923","USB4 WDC WD10JMVW-11AJGS4 WD-WXA1AA6PTY1K"]} ` ## Get port status It powers on the specified port and identies the connected drive. If the state is ` identifying `, the drive detection is still in progress. Continue polling this endpoint until the state changes to either ` ready ` or ` not-detected `. Examples: - ` http://TASKFORCE_IP/api/scan-port?sas8 ` - ` http://TASKFORCE_IP/api/scan-port?EXT1 ` - ` http://TASKFORCE_IP/api/scan-port?SATA1&token=9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478 ` The port identifier is expected as the first raw query item without a parameter name. Named query parameter format like ` ?portId=SATA1 ` is not supported. If ` token ` is used, put it after the port identifier. Returns JSON object: { state, isSource, model, serial, caseId, evidenceId } - state - task-progress, ready, identifying or not-detected - isSource - true or false - model - device model (empty if device is identifying or not detected) - serial - device serial (empty if device is identifying or not detected) - caseId - case identifier - evidenceId - evidence identifier from case ##### query Parameters | required | string Port identifier, consists of port type and number. Case insensitive. This value is not a named query parameter; use ` /api/scan-port?SATA1 `, not ` /api/scan-port?portId=SATA1 `. Example: - ` sata3 ` - ` IDE1 ` Acceptable port names are SATA1, SATA2, SATA3, SATA4, SATA5, SATA6, SAS1, SAS2, SAS3, SAS4, SAS5, SAS6, USB1, USB2, USB3, USB4, IDE1, EXT1 and, for TaskForce 2 only: SATA7, SATA8, SAS7, SAS8, NVME1, NVME2, NVME3, NVME4. | | --- | --- | | token | string User access token provided by the /login endpoint. Required when User Management is enabled in UI settings. If used, it must be placed after the raw port identifier, for example ` /api/scan-port?SATA1&token=... `. Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478 | ### Responses **200** OK **400** Bad request. Any unexpected error. Error message returned as HTTP message body. **401** Unauthorized. User access token is not valid. **408** Timeout. The request took too long. Make sure TaskForce and/or the device from which it is operated are connected to the network. get/scan-port ### Response samples - 200 Content type application/json Copy ` {"state": "task-progress","isSource": true,"model": "SanDisk SDSSDA120G","serial": "171431421695","caseId": "CaseABC123","evidenceId": "dev777"} ` ## Start imaging Launches imaging from a source drive plugged into the specified Source port into a the specified network target folder. By default, target image is a compressed E01 but the file format can be changed in the parameters. Two mandatory parameters: ` source ` and ` targetFolder `. Other parameters have default values, which can be adjusted. Examples: - ` http://TASKFORCE_IP/api/start-image?source=SATA4&targetFolder=//Server/Share ` - ` http://TASKFORCE_IP/api/start-image?source=SATA4 SDSSDA120G Z32081RL&targetFolder=//10.0.0.14/Share ` ##### query Parameters | source required | string Source identifier. It can be specified in two ways: 1) Source port; 2) Source port, drive model and serial Examples: - Source port: ` SATA4 ` - Source port, drive model and serial: ` SATA4 SanDisk SDSSDA120G 171108456213 ` Acceptable port names are SATA1, SATA2, SATA3, SATA4, SATA5, SATA6, SAS1, SAS2, SAS3, SAS4, SAS5, SAS6, USB1, USB2, USB3, USB4, IDE1, EXT1 and, for TaskForce 2 only: SATA7, SATA8, SAS7, SAS8, NVME1, NVME2, NVME3, NVME4. | | --- | --- | | targetFolder required | string Network folder path where target image is created. Supports Linux and Windows formats of path separators (slashes, backslashes). Examples: - ` //10.0.0.14/Share ` - ` //MyServer/Shared-folder ` | | targetFile | string Target image file name without extension. If you don\`t specify this parameter, target file name will be genereted from source disk model and serial. | | settings | string Name of the customized imaging settings. Customized settings can be created and renamed on the imaging start page (after you select the source and the target(s) in UI). Default value: ` Default ` | | targetType | string Type of target image file. It can be **e01**, **aff4**, **raw**, **dd**, or **img**. Default value: ` e01 `. Unsupported values are treated as the default. | | saveReport | string Save report in the target folder alongside with created image file. Accepted values: ` yes `, ` y `, ` no `, ` n `. Values ` true ` and ` false ` are not accepted. Default value: ` yes ` | | targetFolderLogin | string Username or login. Used when ` targetFolder ` points to a password-protected network path. Empty by default. | | targetFolderPwd | string Password. Used when ` targetFolder ` points to a password-protected network path. Empty by default. | | targetFolderDomain | string Network domain. Used when ` targetFolder ` points to a password-protected network path. Empty by default. | | mountOptions | string Mount option for experienced users. Used when ` targetFolder ` points to a network path which requires custom mount options. Empty by default. | | dnsLookup | string TaskForce 2 only option. Specifies the method for resolving the remote server hostname. Acceptable values: - ` taskforce ` - Uses the firmware's hostname resolution logic (default behavior) - ` cifs ` - Uses the mount.cifs hostname resolution logic | | e01Case | string Case ID written to E01 image file metadata. Empty by default. | | e01Evid | string Evidence number written to E01 image file metadata. Empty by default. | | e01Desc | string Description written to E01 image file metadata. Empty by default. | | e01Inv | string Examiner/investigator name written to E01 image file metadata. Empty by default. | | e01Comp | string Indicates whether E01 target image is compressed. Accepted values: ` yes `, ` y `, ` no `, ` n `. Values ` true ` and ` false ` are not accepted. Default value: ` yes ` | | e01Segment | number Specify segment size for E01 file in GB. Minimal segment size is 1GB. Default value: 0 (It means TaskForce will create one E01 file) | | aff4Case | string Case ID written to Aff4 image file metadata. Empty by default. | | aff4Evid | string Evidence number written to Aff4 image file metadata. Empty by default. | | aff4Inv | string Examiner/investigator name written to Aff4 image file metadata. Empty by default. | | aff4Comp | string Specify Aff4 image file compression type. Available options: lz4, snappy, not compressed Default value: ` not compressed ` | | aff4Hash | string Specify Aff4 image file hash type. Available options: md5, sha1, md5+sha1, sha256, sha512 Default value: ` md5+sha1 ` | | token | string User access token provided by the /login endpoint. Required when User Management is enabled in UI settings. Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478 | ### Responses **200** OK. Returns **taskKey** if imaging starts successfully. Use this taskKey to track imaging via /api/check-task. Example: ` /api/check-task?taskKey=image_0_SanDisk%20SDSSDA120G_171108456213_Z32081RL_57eafc6f-e405-485a-be55-b0ab765e4223 ` Expected /api/check-task response fields for this task: ` completionDate `, ` message `, ` report `, ` hashes `, ` errors `, ` state `, ` source `, ` port `, ` task `, ` taskStep `, ` progress `, ` target `. ``` { "completionDate": "2021-12-30 13:30", "message": "completed", "report": "//Server/share/SanDisk SDSSDA120G171108456213_0_E01_report/Report.html", "hashes": { "MD5": "8ab092155e30c77e02a5708bdb1385e2", "SHA1": "47c173429553add911e2686125f9cd702f24ff37" }, "errors": 0, "state": "completed", "source": "SanDisk SDSSDA120G 171108456213", "port": "SATA 4", "task": "image", "taskStep": "post-hash", "progress": 100, "target": "//Server/share/SanDisk SDSSDA120G171108456213_0.E01" } ``` **400** Bad request. Any unexpected error. Error message returned as HTTP message body. **401** Unauthorized. User access token is not valid. **403** Forbidden. Incorrect network path or its credentials. Check whether you specified an existing network path, valid login and password to access a remote shared folder. **408** Timeout. The request took too long. Check network connection with TaskForce. get/start-image ### Response samples - 200 Content type text/plain Copy ``` image_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223 ``` ## Start logical imaging Launches logical imaging from a source drive plugged into the specified Source port into a the specified network target folder. By default, target image is a compressed L01 but the file format can be changed in the parameters. Two mandatory parameters: ` source ` and ` targetFolder `. Other parameters have default values, which can be adjusted. Examples: - ` http://TASKFORCE_IP/api/start-logical?source=SATA4&targetFolder=//Server/Share ` - ` http://TASKFORCE_IP/api/start-logical?source=SATA4 SDSSDA120G Z32081RL&targetFolder=//10.0.0.14/Share ` ##### query Parameters | source required | string Source identifier. It can be specified in two ways: 1) Source port; 2) Source port, drive model and serial Examples: - Source port: ` SATA4 ` - Source port, drive model and serial: ` SATA4 SanDisk SDSSDA120G 171108456213 ` Acceptable port names are SATA1, SATA2, SATA3, SATA4, SATA5, SATA6, SAS1, SAS2, SAS3, SAS4, SAS5, SAS6, USB1, USB2, USB3, USB4, IDE1, EXT1 and, for TaskForce 2 only: SATA7, SATA8, SAS7, SAS8, NVME1, NVME2, NVME3, NVME4. | | --- | --- | | targetFolder required | string Network folder path where target image is created. Supports Linux and Windows formats of path separators (slashes, backslashes). Examples: - ` //10.0.0.14/Share ` - ` //MyServer/Shared-folder ` | | targetFile | string Target image file name without extension. If you don\`t specify this parameter, target file name will be genereted from source disk model and serial. | | settings | string Name of the logical imaging settings with filters. Customized settings can be created and save on the logical imaging start page. Use 3-dot button in the bottom right corner and "Save to" option. Default value: ` Default ` | | targetType | string Type of target image file. In can be either **L01** or **zip**. Default value: ` L01 ` | | saveReport | string Save report in the target folder alongside with created image file. Accepted values: ` yes `, ` y `, ` no `, ` n `. Values ` true ` and ` false ` are not accepted. Default value: ` yes ` | | targetFolderLogin | string Username or login. Used when ` targetFolder ` points to a password-protected network path. Empty by default. | | targetFolderPwd | string Password. Used when ` targetFolder ` points to a password-protected network path. Empty by default. | | targetFolderDomain | string Network domain. Used when ` targetFolder ` points to a password-protected network path. Empty by default. | | mountOptions | string Mount option for experienced users. Used when ` targetFolder ` points to a network path which requires custom mount options. Empty by default. | | dnsLookup | string TaskForce 2 only option. Specifies the method for resolving the remote server hostname. Acceptable values: - ` taskforce ` - Uses the firmware's hostname resolution logic (default behavior) - ` cifs ` - Uses the mount.cifs hostname resolution logic | | l01Case | string Case ID written to L01 image file metadata. Empty by default. | | l01Evid | string Evidence number written to L01 image file metadata. Empty by default. | | l01Desc | string Description written to L01 image file metadata. Empty by default. | | l01Inv | string Examiner/investigator name written to L01 image file metadata. Empty by default. | | compression | string Indicates whether target image is compressed. Accepted values: ` yes `, ` y `, ` no `, ` n `. Default value: ` yes ` | | hash | string Specifies whether each file inside L01 image should include its hash. Available options: md5, sha1, md5+sha1, none Default value: ` md5+sha1 ` | | token | string User access token provided by the /login endpoint. Required when User Management is enabled in UI settings. Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478 | ### Responses **200** OK. Returns **taskKey** if logical imaging starts successfully. Use this taskKey to track logical imaging via /api/check-task. Example: ` /api/check-task?taskKey=logical_0_SanDisk%20SDSSDA120G_171108456213_Z32081RL_57eafc6f-e405-485a-be55-b0ab765e4223 ` Expected /api/check-task response fields for this task: ` completionDate `, ` message `, ` report `, ` errors `, ` state `, ` source `, ` port `, ` task `, ` progress `, ` target `. ``` { "completionDate": "2021-12-30 13:30", "message": "completed", "report": "//Server/share/LogicalImage_report/Report.html", "errors": 1, "state": "completed", "source": "SanDisk SDSSDA120G 171108456213", "port": "SATA 4", "task": "logical", "progress": 100, "target": "//Server/share/LogicalImage.l01" } ``` **400** Bad request. Any unexpected error. Error message returned as HTTP message body. **401** Unauthorized. User access token is not valid. **403** Forbidden. Incorrect network path or its credentials. Check whether you specified an existing network path, valid login and password to access a remote shared folder. **408** Timeout. The request took too long. Check network connection with TaskForce. get/start-logical ### Response samples - 200 Content type text/plain Copy ``` logical_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223 ``` ## Diagnose drive Launches diagnostics of a drive. The diagnostics can be performed for drives in both modes: Source and Target. One mandatory parameter: ` source `. Other parameters have default values, that can be adjusted. Examples: - ` http://TASKFORCE_IP/api/diagnose?source=SATA4 ` - ` http://TASKFORCE_IP/api/diagnose?source=SATA4 SDSSDA120G Z32081RL ` ##### query Parameters | source required | string Identifier of the drive in Source or Target mode. It can be specified in two ways: 1) Drive port; 2) Drive port, drive model and serial Examples: - Drive port: ` SATA4 ` - Drive port, drive model and serial: ` SATA4 SanDisk SDSSDA120G 171108456213 ` Acceptable port names are SATA1, SATA2, SATA3, SATA4, SATA5, SATA6, SAS1, SAS2, SAS3, SAS4, SAS5, SAS6, USB1, USB2, USB3, USB4, IDE1, EXT1 and, for TaskForce 2 only: SATA7, SATA8, SAS7, SAS8, NVME1, NVME2, NVME3, NVME4. | | --- | --- | | reportFolder | string Network folder path where diagnostic report copy will be saved. Supports Linux and Windows formats of path separators (slashes, backslashes). Empty by default. Examples: - ` //10.0.0.14/Share ` - ` //MyServer/Shared-folder ` | | reportFolderLogin | string Username or login. Used when ` reportFolder ` points to a password-protected network path. Empty by default. | | reportFolderPwd | string Password. Used when ` reportFolder ` points to a password-protected network path. Empty by default. | | reportFolderDomain | string Network domain. Used when ` reportFolder ` points to a password-protected network path. Empty by default. | | mountOptions | string Mount option for experienced users. Used when ` reportFolder ` points to a network path which requires custom mount options. Empty by default. | | dnsLookup | string TaskForce 2 only option. Specifies the method for resolving the remote server hostname. Acceptable values: - ` taskforce ` - Uses the firmware's hostname resolution logic (default behavior) - ` cifs ` - Uses the mount.cifs hostname resolution logic | | token | string User access token provided by the api/login endpoint. The token becomes a mandatory parameter when User Management is enabled in UI settings. Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478 | ### Responses **200** OK. Returns **taskKey** if diagnostics start successfully. Use this taskKey to track diagnostics via /api/check-task. Example: ` /api/check-task?taskKey=diagnose_0_SanDisk%20SDSSDA120G_171108456213_Z32081RL_57eafc6f-e405-485a-be55-b0ab765e4223 ` Expected /api/check-task response fields for this task: ` completionDate `, ` message `, ` report `, ` state `, ` source `, ` port `, ` task `, ` progress `. ``` { "completionDate": "2021-12-30 13:30", "message": "Diagnostics completed (API)", "report": "//Server/share/Diagnostics_report.html", "state": "completed-warning", "source": "SanDisk SDSSDA120G 171108456213", "port": "SATA 4", "task": "Diagnostics", "progress": 100 } ``` **400** Bad request. Any unexpected error. Error message returned as HTTP message body. **401** Unauthorized. User access token is not valid. **403** Forbidden. Incorrect network path or its credentials. Check whether you specified an existing network path, valid login and password to access a remote shared folder. **408** Timeout. The request took too long. Check network connection with TaskForce. get/diagnose ### Response samples - 200 Content type text/plain Copy ``` diagnose_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223 ``` ## Compare drives or image files Performs a sector-by-sector comparison between a drive, an image file, or a pattern. Supports multiple comparison modes and optional LBA range filtering: - Compare with ` HEX pattern ` - Compare with ` LBA number signature in each sector ` - 1-to-1 comparison between two disks or between a disk and a file Two mandatory parameters: ` source ` and ` target `. Other parameters have default values, that can be adjusted. Examples: - ` http://TASKFORCE_IP/api/compare?source=SATA2&target=SATA3 ` - ` http://TASKFORCE_IP/api/compare?source=SATA2&target=//10.0.0.11/shared/image.aff4 ` - ` http://TASKFORCE_IP/api/compare?source=SATA2&target=lbaPattern ` - ` http://TASKFORCE_IP/api/compare?source=SATA4 SDSSDA120G Z32081RL&target=00 ` ##### query Parameters | source required | string Source identifier. It can be specified in two ways: 1) Source port; 2) Source port, drive model and serial Acceptable port names are SATA1, SATA2, SATA3, SATA4, SATA5, SATA6, SAS1, SAS2, SAS3, SAS4, SAS5, SAS6, USB1, USB2, USB3, USB4, IDE1, EXT1 and, for TaskForce 2 only: SATA7, SATA8, SAS7, SAS8, NVME1, NVME2, NVME3, NVME4. | | --- | --- | | target required | string Target identifier. It can be specified in several ways: - 1) Target port - 2) Target port, drive model and serial - 3) File path - 4) HEX pattern (e.g., ` 00FFAA `) - 5) ` lbaPattern ` string | | startLba | number Start LBA for comparison. If not specified, the default value is 0. | | endLba | number End LBA for comparison. If not specified, the default value is the last LBA of the disk or image. | | reportFolder | string Network folder path where compare report copy will be saved. Supports Linux and Windows formats of path separators (slashes, backslashes). Empty by default. Examples: - ` //10.0.0.14/Share ` - ` //MyServer/Shared-folder ` | | folderLogin | string Username or login. Used when ` reportFolder ` points to a password-protected network path, or when ` target ` is a password-protected network file path. Empty by default. | | folderPwd | string Password. Used when ` reportFolder ` points to a password-protected network path, or when ` target ` is a password-protected network file path. Empty by default. | | folderDomain | string Network domain. Used when ` reportFolder ` points to a password-protected network path, or when ` target ` is a password-protected network file path. Empty by default. | | mountOptions | string Mount options for experienced users. These options are shared and applied to both ` reportFolder ` (when it points to a network path) and ` target ` (if it is a network file path). Use them when custom mount parameters, credentials, or DNS resolution are required. | | dnsLookup | string TaskForce 2 only option. Specifies the method for resolving the remote server hostname. This setting is applied to both ` reportFolder ` (when it points to a network path) and ` target ` (if it is a network file path). Acceptable values: - ` taskforce ` - Uses the firmware's hostname resolution logic (default behavior) - ` cifs ` - Uses the mount.cifs hostname resolution logic | | token | string User access token provided by the /login endpoint. Required when User Management is enabled in UI settings. Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478 | ### Responses **200** OK. Returns **taskKey** if comparison starts successfully. Use this taskKey to track comparison via /api/check-task. Example: ` /api/check-task?taskKey=compare_0_SanDisk%20SDSSDA120G_171108456213_Z32081RL_57eafc6f-e405-485a-be55-b0ab765e4223 ` Expected /api/check-task response fields for this task: ` completionDate `, ` message `, ` report `, ` errors `, ` processedSectors `, ` differentSectors `, ` state `, ` source `, ` port `, ` task `, ` progress `. ``` { "completionDate": "2021-12-30 13:30", "message": "Comparison completed (API)", "report": "//Server/share/Compare_report.html", "errors": 0, "processedSectors": 1000, "differentSectors": 128, "state": "completed", "source": "SanDisk SDSSDA120G 171108456213", "port": "SATA 4", "task": "Compare", "progress": 100 } ``` **400** Bad request. Any unexpected error. Error message returned as HTTP message body. **401** Unauthorized. User access token is not valid. **403** Forbidden. Incorrect network path or its credentials. Check whether you specified an existing network path, valid login and password to access a remote shared folder. **408** Timeout. The request took too long. Check network connection with TaskForce. get/compare ### Response samples - 200 Content type text/plain Copy ``` compare_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223 ``` ## Check task status Gets data about the progress of running or completed tasks. Requires ` taskKey ` or ` source ` parameter: - ` taskKey ` value is generated in response to /start-image, /start-logical, /diagnose or /compare request. - ` source ` value can be specified in two ways: 1) Source port; 2) Source port, drive model and serial. Example: - ` http://TASKFORCE_IP/api/check-task?taskKey=image_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223 ` - ` http://TASKFORCE_IP/api/check-task?source=SATA5 ` Returns a JSON object with fields that are applicable to the checked operation. Fields that do not belong to an operation are omitted. - state - completed, failed, progress, paused, completed-warning, stopped or initial - task - name of the task. Example: image - taskStep - a stage of the task. For imaging it can be: pre-hash, image, post-hash. For diagnostics possible stages are: Circuit board, File system, Firmware, Heads and Media scan. - source - source device model and serial - port - unit port where a device was plugged in. Example: SATA 3 - progress - shown in percents. If state=failed, then progress=-1 - errors - number of task-specific errors. For Imaging it is unreadable sectors; for Logical it is files with errors; for Compare it is unreadable sectors. Diagnostics responses do not include this field. - message - additional information - completionDate - completion date and time of the task - target - file path to the network target image - report - file path to the network task report - hashes - one or two image hashes calculated during imaging - processedSectors - number of processed sectors for Compare - differentSectors - number of different sectors detected by Compare ##### query Parameters | taskKey | string Task identifier. It is generated in response to /start-image, /start-logical, /diagnose or /compare request. Either this parameter or source must be specified. Example: - ` image_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223 ` | | --- | --- | | source | string Source identifier. It can be specified in two ways: 1) Source port; 2) Source port, drive model and serial. Either this parameter or taskKey must be specified. Examples: - Source port: ` SATA4 ` - Source port, drive model and serial: ` SATA4 SanDisk SDSSDA120G 171108456213 ` Acceptable port names are SATA1, SATA2, SATA3, SATA4, SATA5, SATA6, SAS1, SAS2, SAS3, SAS4, SAS5, SAS6, USB1, USB2, USB3, USB4, IDE1, EXT1 and, for TaskForce 2 only: SATA7, SATA8, SAS7, SAS8, NVME1, NVME2, NVME3, NVME4. | | token | string User access token provided by the /login endpoint. Required when User Management is enabled in UI settings. Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478 | ### Responses **200** OK **400** Bad request. Any unexpected error. Error message returned as HTTP message body. **401** Unauthorized. User access token is not valid. **408** Timeout. The request took too long. Check network connection with TaskForce. get/check-task ### Response samples - 200 Content type application/json Example Imaging Check responseLogical Check responseDiagnostic Check responseCompare Check responseImaging Check response Copy Expand all Collapse all ` {"completionDate": "2021-12-30 13:30","message": "completed","report": "//Server/share/SanDisk SDSSDA120G171108456213_0_E01_report/Report.html","hashes": {"MD5": "8ab092155e30c77e02a5708bdb1385e2","SHA1": "47c173429553add911e2686125f9cd702f24ff37"},"errors": 0,"state": "completed","source": "SanDisk SDSSDA120G 171108456213","port": "SATA 4","task": "image","taskStep": "post-hash","progress": 100,"target": "//Server/share/SanDisk SDSSDA120G171108456213_0.E01"} ` ## Stop running task Running this request pauses active task or stop it (for tasks that can not be paused). Corresponding task report will be created. Paused task can be restarted in TaskForce user interface. Either ` taskKey ` or ` source ` is mandatory. Use only one of them. Example: - ` http://TASKFORCE_IP/api/stop-task?taskKey=image_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223 ` - ` http://TASKFORCE_IP/api/stop-task?source=SATA1%20ST500LM012%20HN-M500MBB ` ##### query Parameters | taskKey | string Task identifier. It is generated in response to /start-image, /start-logical, /diagnose or /compare request. Either this parameter or source must be specified. Example: - ` image_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223 ` | | --- | --- | | source | string Source identifier. Specify source port, drive model and serial. Either this parameter or taskKey must be specified. Example: - Source port, drive model and serial: ` SATA1 ST500LM012 HN-M500MBB ` | | token | string User access token provided by the /login endpoint. Required when User Management is enabled in UI settings. Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478 | ### Responses **200** OK **400** Bad request. Any unexpected error. Error message returned as HTTP message body. **401** Unauthorized. User access token is not valid. **408** Timeout. The request took too long. Make sure TaskForce and/or the device from which it is operated are connected to the network. get/stop-task ## Create case Creates a new case for a drive and associates it with the provided case details. Use this endpoint to start tracking a new forensic case for a specific drive. The drive must be identified and powered on at one of the available ports before calling this endpoint. The drive cannot be busy with another running task. Specifying ` source ` or pair of ` model ` + ` serial ` is mandatory to identify the drive. Examples: - ` http://TASKFORCE_IP/api/create-case?source=SATA4%20SanDisk%20SDSSDA120G%20171108456213&caseId=CASE-001&caseDescription=Evidence%20from%20suspect%20laptop ` - ` http://TASKFORCE_IP/api/create-case?model=SDSSDA120G&serial=171108456213&caseId=CASE-001&evidenceId=EV-001 ` ##### query Parameters | source | string Drive identifier in a format retrievable from ` /scan-devices ` request. Drive must be identified and powered on respective port. Examples: - Source port, drive model and serial: ` SATA4 SanDisk SDSSDA120G 171108456213 ` | | --- | --- | | model | string Model of the drive. It can be retrieved using the ` /scan-port ` request endpoint. - Must be provided alongside the ` serial ` parameter. | | serial | string Serial number of the drive. It can be retrieved using the ` /scan-port ` request endpoint. - Must be provided alongside the ` model ` parameter. | | caseId | string If provided, Case ID field will be assigned to this value. It must be unique within the system if TaskForce setting ‘Allow non-unique case names’ is disabled. | | caseExaminer | string If provided, Case examiner field will be assigned to this value. | | caseDescription | string If provided, Case description field will be assigned to this value. | | caseLocation | string If provided, Case location field will be assigned to this value. | | caseOrganization | string If provided, Case organization field will be assigned to this value. | | evidenceId | string The identifier used to link the drive to a case. If provided, Evidence ID field will be assigned to this value. | | evidenceExaminer | string If provided, Evidence examiner field will be assigned to this value . | | token | string User access token provided by the /login endpoint. Required when User Management is enabled in UI settings. Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478 | ### Responses **200** OK. Case created successfully. **400** Bad request. Drive not found, drive is busy, or invalid parameters. Error message returned as HTTP message body. **401** Unauthorized. User access token is not valid. **408** Timeout. The request took too long. Make sure TaskForce and/or the device from which it is operated are connected to the network. get/create-case ## Edit case Updates the details of an existing case. Use this endpoint to modify case information such as description, examiner, location, or organization for a previously created case. The case must be associated with the specified caseId. If no matching case is found, the request will fail with an error. Examples: - ` http://TASKFORCE_IP/api/edit-case?caseId=CASE-001&caseDescription=Updated%20description&caseExaminer=John%20Smith ` ##### query Parameters | caseId required | string The identifier used to locate the case to update. - If one or more matching cases are found, the most recently used case will be selected for details update. - If no matching case is found, the request will fail with an error. | | --- | --- | | caseExaminer | string The new name or ID to be assigned as the case examiner. If provided, this value will overwrite the existing examiner field for the case. | | caseDescription | string The new text value to assign as the case description. If provided, this value will overwrite the existing description field for the case. | | caseLocation | string The new text value to assign as the case location. If provided, this value will overwrite the existing location field for the case. | | caseOrganization | string The new text value to assign as the case organization. If provided, this value will overwrite the existing organization field for the case. | | evidenceId | string The identifier used to locate evidence in the case to update the evidence examiner name. The new evidence examiner name must be specified by ` evidenceExaminer `. The new evidence examiner value will be assigned to all evidence drives that match this identifier. | | evidenceExaminer | string The new name for the evidence examiner which is defined by the specified ` evidenceId ` | | token | string User access token provided by the /login endpoint. Required when User Management is enabled in UI settings. Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478 | ### Responses **200** OK. Case updated successfully. **400** Bad request. Case not found or invalid parameters. Error message returned as HTTP message body. **401** Unauthorized. User access token is not valid. **408** Timeout. The request took too long. Make sure TaskForce and/or the device from which it is operated are connected to the network. get/edit-case ## Download report Downloads a report for a task. HTTP response is as follows: For /start-image, /start-logical and /compare tasks, a text/plain with a ZIP file containing all report files and logs is attached in the Content Disposition header. For /diagnose task, a text/plain with an HTML report file is attached in the Content Disposition header. The ` taskKey ` is a mandatory parameter. Its value is generated in response to a /start-image, /start-logical, /diagnose, or /compare request. Example: - ` http://TASKFORCE_IP/api/report?taskKey=image_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223 ` ##### query Parameters | taskKey required | string Task identifier. It is generated in response to /start-image, /start-logical, /diagnose or /compare request. Example: - ` image_0_SanDisk%20SDSSDA120G_171108456213_Z32080R_57eafc6f-e405-485a-be55-b0ab765e4223 ` | | --- | --- | | token | string User access token provided by the /login endpoint. Required when User Management is enabled in UI settings. Example: 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478 | ### Responses **200** OK **400** Bad request. Any unexpected error. Error message returned as HTTP message body. **401** Unauthorized. User access token is not valid. **408** Timeout. The request took too long. Make sure TaskForce and/or the device from which it is operated are connected to the network. get/report ### Response samples - 200 Content type text/plain Example diagnosticTaskResponseimagingTaskResponsediagnosticTaskResponse Copy ``` Content-Disposition: "attachment; filename=taskKey.html" ``` ## Login as user Validates user credentials from HTTP request body. If valid and associated with an existing user, it will issue an access token. Note: User management must be activated in UI settings. Example: - ` http://TASKFORCE_IP/api/login ` ##### Request Body schema: application/json required | username required | string Name of existing TaskForce user. | | --- | --- | | password required | string Password of the user. | ### Responses **200** OK **400** Bad request. Any unexpected error. Error message returned as HTTP message body. **401** Unauthorized. User credentials are not valid. **408** Timeout. The request took too long. Make sure TaskForce and/or the device from which it is operated are connected to the network. post/login ### Request samples - Payload Content type application/json Copy ` {"username": "admin","password": 12345} ` ### Response samples - 200 Content type text/plain Copy ``` 9b6af926253943f38f29c73b3dcdfd9ac761350b0713b07aed49c9348a4bf478 ``` ## Show API documentation Opens this API documentation page. ### Responses **200** OK get/help Source: https://atola.com/products/taskforce/api