TaskForce Changelog

2022.10

New Features

RAID:

• New stage 4 of RAID configuration autodetection starts in case three initial stages were unsuccessful: automatic search of a missing device in RAID 5.
• APFS support (unencrypted volumes only).
• Improved RAID autodetection due to an enhanced file system validation algorithm.
• Partition table in a tooltip for MBR device tag.

Logical imaging:

• APFS support, including encrypted volumes.
• ZIP file supported as a target logical container.
• New Web API call: /start-logical – launches logical imaging session to L01 or ZIP.
• New button Check. Allows to check the specified file filters and download the matched files as CSV.

Express mode: USB drives supported.

Wiping: New Format NVMe method for NVMe SSDs.

Diagnostics:

• AMA max address detection during firmware check.
• Shows APFS volumes and containers.

HPA, DCO, and AMA: Other tasks > Hidden drive areas. New functionality enables changing and unclipping of HPA, DCO, and AMA.

New user management system:

• It can be activated in System settings.
• Admin & User roles.
• Case access restrictions by user.
• Auto-lock screen with user password.

Case management:

• One case can include multiple drives.
• Same drive can belong to multiple cases.

AFF4 image file reading and validation. Performance increased by 120%.

Imaging: Adjacent single read errors in the logs are merged into sector ranges. It makes log smaller when imaging a damaged drive.

QR code added to ease TaskForce activation.

Bugfixes

Imaging of WD_BLACK NVMe drives could not be started due to underscore in the model name.

Incorrect behavior during Resume of a paused imaging session to an image on a powered-off Storage drive.

Failed to open network shares with passwords containing several special characters (e.g. ! , : “).

Diagnostics:

• Rare head check error possible on old IDE drives.
• Rare specific error when reading SMART temperatures and not showing the graph.

RAID: Too many Mirror tags when all devices have the same data.

Issue with FAT32 file extensions in Logical and Browse Files.

2022.4

New Features

Logical imaging feature-set:

• 12+ parallel logical imaging sessions
• Ability to pause and continue each session
• L01 target images stored in the network or a destination drive
• Advanced logical image acquisition using include/exclude filters
• Supported file systems: NTFS, ext4/3/2, exFAT, XFS, HFS, HFS+, HFSX, FAT32/16

Imaging:

• SHA hash calculation performance increased by 50%, reaching 1GB/s speed now
• SHA-256 and SHA-512 calculation when imaging to E01 file. Hashes are stored in the imaging report only.
• New Web API call: /report – downloads ZIP-file with imaging report, log and additional CSV files if segmented hashes and file signatures enabled
• Reading NVMe source drive SMART attributes before and after imaging

RAID:

• New stage 3 of RAID configuration detection (extended) added
• Better autodetection of RAID array with non-zero Start LBA
• Improved NTFS automatic validation
• Added explanatory tooltips for RAID tags: Spare, MBR

Diagnostics:

• NVMe drives supported
• Click on the ‘Diagnose’ button powers up and identifies drives by default
• File system check. Partition labels are displayed now

New system settings:

• Show ‘Add case’ button on TaskForce top panel
• Set date and time automatically or manually
• Print settings moved to settings instead of popping up in a dialog after every Print action

An improved user experience when printing multiple reports.

File manager. New ‘Create folder’ button.

Other -> View SMART. NVMe drive support.

System log improved to provide better TaskForce diagnostics and tech support.

Bugfixes

Some SSD models could not be identified on SATA ports after power cycling TaskForce

It was impossible to parse an NTFS partition created on an external drive by Xbox One S

NTFS parsing error for partitions with cluster size > 128KB

Incorrect capacity detection of WD MyBook 4TB USB drives

A missing detection hint after RAID auto assembly restart for an array created with mdadm

IP display could have an IP address missing in rare cases

Device page. Showing invalid Modified Dates of target image files on a Storage drive

A lengthy Case Description could cause reports to look buggy

2021.8

New Features

Imaging:

• Live stats of file signatures
• Target HEX viewer with the imaged raw sector data displayed in real-time with a freeze option
• Fast RAID 10 imaging
• XFS support when imaging only sectors with data

RAID:

• RAID 10 autodetection and group management
• XFS support
• Enhanced RAID autodetection algorithm

Diagnostics. USB drive supported

Other > Browse files. XFS supported in the file system preview

In Web API, /check-task query has a new result field: hashes

In reports and running tasks, the top right Case ID is clickable for identifiable devices

Bugfixes

Imaging:

• Imaging could fail to start when switching settings from Linear hashing to Segmented hashing and disabling all hash types
• Few UI fixes of imaging presets

Some models of USB flash drives had an incorrect capacity

Rare case when opening network folders was too slow during image file selection

RAID-mounted drives could be mistakenly powered down when staying in idle mode for 5 minutes

Diagnostics. Invalid "The motor does not consume proper current on spinup. The motor may be stuck, or the circuit board is malfunctioning." diagnosis for SSDs with non-working PCB

File manager. "Create file" button was missing after unlocking a password-protected network folder

Express mode. "User action required" dialog was not showing for Resume and Retry imaging situations

It was impossible to set a non-Latin Case ID

2021.4

New Features

Imaging:

• AFF4 image file support
• Imaging to compressed E01. Performance increased by 100%
• Detailed speed stats during imaging to reveal bottlenecks
• Manual jump when you click the imaging progress bar
• Revamped imaging presets: 
  • New local presets which are saved in your browser
  • Damaged drive preset

Multi-launch mode for Wipe, Hash, Diagnose and other single device tasks.

RAID:

• exFAT support
• HFS/HFS+ support

Wiping:

• New wiping method: Secure Erase 
• Option to automatically unclip HPA/DCO before wiping

Other > Browse Files - file browser for devices and images.

M.2 Extension. Support of NVMe drive hot-swap.

Support of HTTPS with external organizational and self-signed certificates.

Device status tag for quick display of the last diagnostics result or lack thereof.

Bugfixes

Imaging:

• Image hash was not stored in E01 target file if a read error occurred
• Possible write error when imaging a 16TB+ drive to an uncompressed E01 target image file
• Imaging couldn’t launch if target directory had a comma (,) character in its path
• Inability to resume imaging to E01 compressed file if you pause it during a read error
• Minor issues with reverse imaging mode and automatic jumps
• A slight deviation in free space calculation of Storage

RAID. Failed RAID configuration autodetection when facing NTFS partition with filenames longer than 127 bytes.

Logs, Non-device reports, Information about the hardware unit's components were not included when generating a large report from multiple cases.

2020.7.1

New Features

RAID:

• Improved RAID autodetection. Fine-tuned algorithms will narrow the possible configurations down to a single variant more frequently
• When multiple RAID assumptions are suggested, they are listed in the order of probability
• New Error tag is displayed if read errors are encountered during RAID autodetection. The tag's tooltip shows read error count
• Improved handling of a damaged drive when one of RAID devices freezes while reading sectors
• Memory use optimized for RAID autodetection involving more than 8 devices
• Maximum number of autochecked configurations increased from 500,000 to 100,000,000
• RAID 5. Ability to add a Missing Device and start another RAID autodetection
• RAID 5 based on mdadm. Automatic addition of a Missing Device
• Summary hint with recommendations is shown if RAID autodetection failed to find the right RAID configuration

Network setup + Imaging to server:

• DFS (Distributed File System) supported
• Connect dialog allows specifying a full network folder path
• New network settings: DNS nameserver, Default gateway
• Ability to work in networks having SMBv2 strictly disabled

Bugfixes

Imaging:

• The following message was missing in the imaging log: Source device HPA was set to native max address until power cycle: 123,123,123
• Imaging could not be started if limiting the target device to source size by HPA failed
• Rare imaging interruption when attempting to start selective head imaging with some models of Toshiba drives
• Imaging (Hashing, Wiping, as well) could not be started against NetAPP SAS drives
• Disable read-look ahead setting was not working properly
• Resuming imaging for RAID wasn't possible after pausing imaging and changing the RAID configuration

Other fixes:

• RAID. Serial numbers of selected devices were not always entirely visible on RAID configuration page
• RAID. Add devices buttons and Remove device area missing when using screen tablet with 6+ devices selected
• Storage drive automounting now works in Target mode only. Previously, it was running for both Source and Target modes.
• Fixed a few minor issues with case reports created for RAID devices
• Case import completed report might have no detailed information inside

2020.7

New Features

RAID support:

• Autodetection of RAID configuration
• Convenient assembly with partition preview
• Supported RAID types: RAID 0, 1, 5 and JBOD
• Missing drive support in RAID 5
• Supported file systems for RAID autodetection: NTFS, ext4/3/2

Imaging:

• Imaging assembled RAID array or its individual partitions
• Add, change and delete passes of a paused imaging session
• E01 evidence number, investigator, description are added to the final imaging report
• Ability to restore image file to 4Kn drive
• Save report in the target folder option became enabled by default

Case management:

• SAVE TO button on Reports page. Allows to quickly save and export selected reports in a single ZIP file.
• Remote work folder. Performance optimization for cases when 15+ tasks are running simultaneously.
• Improved report search for non-English languages
• Ability to reindex currently selected Work Folder

Support of SAS drives with sector size above 4096 sectors

UI changes on the device selection panel

• Fast device actions: Power on/off, Reidentify, Unmount storage
• Device power indication

Home page. Specific port indicated for each device report

Bugfixes

• Imaging to E01 could not get started if source device’s serial number was longer than 50 characters
• Resuming imaging session could fail if target image folder is password-protected
• Out of memory error while importing large work folder package files
• Possible minor issues with segmented hashes after imaging paused and resumed
• Fixed HTML styling when a case report is opened outside TaskForce
• Seagate SSD 600 Pro drive was not detected in the device selection panel
• Incorrect values of Last open date in Cases page

2020.3.1

Changes

• Revamped Chinese texts
• Mistakes in Chinese and Japanese translations

2020.3

New Features

Imaging:

Segmented hashes – an alternative to linear hashing. It will come in handy when dealing with damaged drives or providing enhanced resiliency against data corruption.

Bugfixes

• TaskForce browser-cached data was not always refreshed after firmware update
• Target files with long Chinese/Japanese names could not be created
• Few minor issues when imaging into E01 files

2020.2

New Features

Imaging:

• E01 segmented files (E01, E02, etc) supported
• Web API, /start-image call. New targetFile parameter allowing to customize target image file name

Auto-mount of VeraCrypt-encrypted Storage when its diagnostics completes

Bugfixes

• Few minor issues when doing case import from Storage
• Cancel button was not working during case export

2020.1

New Features

Imaging:

• Create encrypted password-protected VeraCrypt volume on a target drive to store images
• Recent folder tiles in Device panel's File section to speed up target file location choice
• Optimization of TaskForce memory usage when imaging to E01
• Visual checkmarks in reports to compare hashes during and after imaging

Case management:

• Case export to a USB stick or any other Storage
• Case import from a USB stick or any other Storage
• Deletion of cases and reports

User experience improvements:

• Revamped UI across the whole interface
• File browser: faster folder opening, cleaner look & feel
• More accessible smartphone UI

Support of SAS drives with non-standard sector sizes: 520, 528, 4080 bytes, etc

Settings page shows MAC addresses of both TaskForce Ethernet ports

Web API, /check-task call:

• New query parameter - source. Example: /api/check-task?source=SATA5
• New result fields: source, completionDate

Manual is now built into TaskForce firmware

Bugfixes

Imaging:

• Issue mounting Oracle ZFS NAS to store image files
• It was impossible to select a network target folder with password-protected Guest account
• Small sector blocks were not visible in the imaging map progress bar

Other fixes:

• Possible E01 validation issue when selecting huge 10TB+ image
• Occasional error when formatting a target drive to Storage with exFAT
• FalseThe disk claims that it won't read multiple sectors at a time message in Diagnostics (rare case)
• Cancel button wasn't properly working during the operations:  Identifying device, Creating target file, Checking source device

2019.9

New Features

Imaging

• Express mode - a self-launching imaging mode. Plugging a source drive into port automatically starts imaging process
• Imaging by selected heads. Support for most of Seagate, WD, Hitachi, Toshiba models
• Suggestion to disable damaged/degraded heads when starting the first imaging session

Diagnostics

• Detection of degraded and damaged heads
• By-head speed graphs
• Showing SMART’s Power on Time in human-readable form

Storages

• Automounting of Storage drives
• Imaging into more than one E01/Raw file on Storage
• Save report in the target folder option supported
• Showing available space and image files Storage drive contains
• Stricter check and confirmation request when someone attempts to wipe Storage
• Open file selection dialog after one clicks Storage in the device selection panel
• Ability to resume imaging session to compressed E01 located on Storage

Drive identification is now 3-4 times faster when you open the device selection panel

Support of damaged USB flash drives which are in read-only mode

Improved recognition of vendor-specific SMART attributes

Bugfixes

Imaging

• It was impossible to resume imaging session after target device write error
• Errors when writing USB drives with a capacity above 2 TB
• SATA drive plugged into SAS port could get paused after source drive hung up
• Possible errors when imaging 4kN SAS drive to 4kN SATA drive
• Export of imaged sector list was failing when CSV file became larger than 5 MB
• Empty image file could be created when imaging fails to start
• Few corner-case issues when using reverse imaging passes

Other fixes

• File selection dialog was showing E01 image size instead of real file size
• Diagnostics. Last significant work time interval was not always correct
• False detection of DCO max address limitation in rare cases

2019.7

New Features

Introduction of simple Web API with 5 commands:

• /start-image – launches an imaging session
• /check-task – returns the status of an imaging task
• /scan-devices – find all source drives available for imaging
• /stop-task – stops imaging session
• /help – opens API documentation

New system setting: Store shared folder logins and passwords in TaskForce

Case ID is now displayed in the device selection window.

Bugfixes

• Target drive serial numbers were missing in imaging reports
• Restoring file image from password-protected network folder denied
• File selection window was too wide when open on mobile phone
• WrappedApiResultException when parsing partition with bad sectors

2019.4.1

Bugfixes

• Imaging to a large non-compressed E01 file located on a target device sometimes interrupted due to a write error
• Very rare internal out-of-memory error when working with E01 files on target device

2019.4

New Features

• Imaging
• Image files can be created on exFAT-formatted target drives
• Support of imaging to E01 compressed files
• Imaging to E01. Performance increase by 100%.
• Imaging. Performance enhancement for SAS ports: 100-200% increase depending on the combination of source and target types
• Support of remote work folder to store case data on a network server
• Cases. New option Set case details before task start
• Diagnostics. Drive temperature graph and drive working timespans
• Wiping. The speed of random and LBA pattern methods accelerated by 100%
• New method of TaskForce firmware update: from USB stick
• Japanese language support

Bugfixes

• E01 files. Partitions might not be found in other forensic tools (X-Ways, Encase)
• It was impossible to select an image file with “+” sign in its filename
• USB drives. Intermittent unsuccessful identification of certain USB drives
• INTEL SSDSC2KB240G7 solid-state drive model was not identifiable
• False Device isn't connected to TaskForce or is not responding message on certain enterprise SAS drives
• Diagnostics. Rare incorrect According to the status register, circuit board is malfunctioning message for drives on SAS ports
• Diagnostics. Estimated imaging time indication was missing for old drives with capacity below < 7 GB
• Diagnostics. Short circuit diagnosis could be missing when short circuit is detected.

2018.12

New Features

• NVMe support!
• Support of M.2, Thunderbolt, and Apple PCIe extension modules
• Imaging
• The option to image all sectors with data
  Supported file systems: NTFS, APFS, ext2/3/4, HFS, HFS+, ExFAT, FAT16, FAT32
• Unclip HPA until power cycle on source drives
• Pause and Resume features support for pre-hash and post-hash calculation during imaging session
• SAS port. Performance increase by 25%
• Improved imaging of damaged drives
• New setting Save report in the target folder when imaging to a file
• E01 metadata automatically filled with case ID, investigator, description from the case management system
• User interface
• Fully revamped UI with center-aligned pages
• Better UI version for smartphones
• Short values (1K, 1M, 1G, 1T) supported in all LBA text boxes
  Example: 3M will transform into 3,000,000
• 4K sector size support on SATA, SAS, USB drives
• Wiping. Added methods: NIST 800-88, DOD 5220, Random, LBA Number
• System menu. Added Release notes page and Toggle full screen feature

Bugfixes

• USB devices. On certain devices, bad sectors were detected but not reported in the logs
• Warning when opening E01 file in Encase created by Atola TaskForce
• HPA/DCO indication missing on SATA devices plugged to SAS ports
• Issues identifying drives in PUIS mode
• Unclip HPA/DCO not working on IDE drives
• Several translation inaccuracies in the Chinese version

2018.8

New Features

• Imaging
• Overall performance increase by 25% when imaging to network shared folders
• Imaging presets with export/import features
• Export of imaged/non-imaged/error sectors into a file
• Sparse file support when writing into target images
• Improved damaged drive support for disks that freeze in the course of imaging
• Option to automatically limit target drive capacity to match that of the source via HPA
• Hashing. 100% performance increase of double-hash (MD5+SHA1) calculation reaching 650 MB/s
• Case management
• Export of one or multiple cases into a file
• Import of cases from a file
• Navigation between reports via new arrow buttons in the bottom panel
• Improvement in printing of multiple reports
• Diagnostics. Improved Media Surface check for solid-state drives
• SAS drives. SMART support
• SATA drives. Added PHY link in the bottom panel
• E01 metadata is now automatically filled from the corresponding case

Bugfixes

• Imaging. Improved graph animation smoothness for large screen resolutions
• Imaging. After read error, error type was not showing in a corresponding log message
• Diagnostics. Removed incorrect error message for partitions larger than 8TB
• Issue when a task may not start when drive power is off
• E01 files. Invalid E01 metadata when non-Latin characters are used in Description and Investigator fields
• Issue with SATA drives in PUIS mode not getting identified in rare cases
• Multiple UI fixes

2018.1.3

New Features

• Imaging to password-protected servers and network folders
• Static IP mode for both 10Gbit Ethernet ports

2018.1.2

Chinese language support

2018.1.1

Bugfixes

• Diagnose. Error when scanning a partition of more than 2TB size
• Activation. Intermittent error during the first system activation
• Fixed other minor issues

2018.1

Initial release