TaskForce Changelog
2020.7.1
RAID:
- Improved RAID autodetection. Fine-tuned algorithms will narrow the possible configurations down to a single variant more frequently
- When multiple RAID assumptions are suggested, they are listed in the order of probability
- New Error tag is displayed if read errors are encountered during RAID autodetection. The tag's tooltip shows read error count
- Improved handling of a damaged drive when one of RAID devices freezes while reading sectors
- Memory use optimized for RAID autodetection involving more than 8 devices
- Maximum number of autochecked configurations increased from 500,000 to 100,000,000
- RAID 5. Ability to add a Missing Device and start another RAID autodetection
- RAID 5 based on mdadm. Automatic addition of a Missing Device
- Summary hint with recommendations is shown if RAID autodetection failed to find the right RAID configuration
Network setup + Imaging to server:
- DFS (Distributed File System) supported
- Connect dialog allows specifying a full network folder path
- New network settings: DNS nameserver, Default gateway
- Ability to work in networks having SMBv2 strictly disabled
Bugfixes
Imaging:
- The following message was missing in the imaging log: Source device HPA was set to native max address until power cycle: 123,123,123
- Imaging could not be started if limiting the target device to source size by HPA failed
- Rare imaging interruption when attempting to start selective head imaging with some models of Toshiba drives
- Imaging (Hashing, Wiping, as well) could not be started against NetAPP SAS drives
- Disable read-look ahead setting was not working properly
- Resuming imaging for RAID wasn't possible after pausing imaging and changing the RAID configuration
Other fixes:
- RAID. Serial numbers of selected devices were not always entirely visible on RAID configuration page
- RAID. Add devices buttons and Remove device area missing when using screen tablet with 6+ devices selected
- Storage drive automounting now works in Target mode only. Previously, it was running for both Source and Target modes.
- Fixed a few minor issues with case reports created for RAID devices
- Case import completed report might have no detailed information inside
2020.7
RAID support:
- Autodetection of RAID configuration
- Convenient assembly with partition preview
- Supported RAID types: RAID 0, 1, 5 and JBOD
- Missing drive support in RAID 5
-
Supported file systems for RAID autodetection: NTFS, ext4/3/2
Imaging:
- Imaging assembled RAID array or its individual partitions
- Add, change and delete passes of a paused imaging session
-
E01 evidence number, investigator, description are added to the
final imaging report
- Ability to restore image file to 4Kn drive
-
Save report in the target folder option became enabled by
default
Case management:
-
SAVE TO button on Reports page. Allows to quickly save
and export selected reports in a single ZIP file.
-
Remote work folder. Performance optimization for cases when 15+
tasks are running simultaneously.
- Improved report search for non-English languages
- Ability to reindex currently selected Work Folder
Support of SAS drives with sector size above 4096 sectors
UI changes on the device selection panel
-
Fast device actions: Power on/off, Reidentify, Unmount storage
- Device power indication
Home page. Specific port indicated for each device report
Bugfixes
-
Imaging to E01 could not get started if source device’s serial
number was longer than 50 characters
-
Resuming imaging session could fail if target image folder is
password-protected
-
Out of memory error while importing large work folder package
files
-
Possible minor issues with segmented hashes after imaging paused
and resumed
-
Fixed HTML styling when a case report is opened outside
TaskForce
-
Seagate SSD 600 Pro drive was not detected in the device
selection panel
-
Incorrect values of Last open date in Cases page
2020.3.1
May 22, 2020
- Revamped Chinese texts
- Mistakes in Chinese and Japanese translations
2020.3
March 26, 2020
Imaging:
Segmented hashes – an alternative to linear hashing. It will come in handy when dealing with damaged drives or providing enhanced resiliency against data corruption.
Bugfixes
- TaskForce browser-cached data was not always refreshed after firmware update
- Target files with long Chinese/Japanese names could not be created
- Few minor issues when imaging into E01 files
2020.2
February 27, 2020
Imaging:
-
E01 segmented files (E01, E02, etc) supported
-
Web API, /start-image call. New targetFile parameter allowing to customize target image file name
Auto-mount of VeraCrypt-encrypted Storage when its diagnostics completes
Bugfixes
- Few minor issues when doing case import from Storage
- Cancel button was not working during case export
2020.1
Imaging:
-
Create encrypted password-protected VeraCrypt volume on a target
drive to store images
-
Recent folder tiles in Device panel's File section to speed up target file location choice
- Optimization of TaskForce memory usage when imaging to E01
-
Visual checkmarks in reports to compare hashes during and after
imaging
Case management:
- Case export to a USB stick or any other Storage
- Case import from a USB stick or any other Storage
- Deletion of cases and reports
User experience improvements:
- Revamped UI across the whole interface
- File browser: faster folder opening, cleaner look & feel
- More accessible smartphone UI
Support of SAS drives with non-standard sector sizes: 520, 528, 4080
bytes, etc
Settings page shows MAC addresses of both TaskForce Ethernet ports
Web API, /check-task call:
-
New query parameter - source. Example:
/api/check-task?source=SATA5
- New result fields: source, completionDate
Manual is now built into TaskForce firmware
Bugfixes
Imaging:
- Issue mounting Oracle ZFS NAS to store image files
-
It was impossible to select a network target folder with
password-protected Guest account
-
Small sector blocks were not visible in the imaging map progress
bar
Other fixes:
-
Possible E01 validation issue when selecting huge 10TB+ image
-
Occasional error when formatting a target drive to Storage with
exFAT
-
FalseThe disk claims that it won't read multiple sectors at a time message in Diagnostics (rare case)
-
Cancel button wasn't properly working during the operations:
Identifying device, Creating target file, Checking source
device
2019.9
Imaging
- Express mode - a self-launching imaging mode. Plugging a source drive into port automatically
starts
imaging process
- Imaging by selected heads. Support for most of Seagate, WD, Hitachi, Toshiba models
- Suggestion to disable damaged/degraded heads when starting the first imaging session
Diagnostics
- Detection of degraded and damaged heads
- By-head speed graphs
- Showing SMART’s Power on Time in human-readable form
Storages
- Automounting of Storage drives
- Imaging into more than one E01/Raw file on Storage
- Save report in the target folder option supported
- Showing available space and image files Storage drive contains
- Stricter check and confirmation request when someone attempts to wipe Storage
- Open file selection dialog after one clicks Storage in the device selection panel
- Ability to resume imaging session to compressed E01 located on Storage
Drive identification is now 3-4 times faster when you open the device selection panel
Support of damaged USB flash drives which are in read-only mode
Improved recognition of vendor-specific SMART attributes
Bugfixes
Imaging
- It was impossible to resume imaging session after target device write error
- Errors when writing USB drives with a capacity above 2 TB
- SATA drive plugged into SAS port could get paused after source drive hung up
- Possible errors when imaging 4kN SAS drive to 4kN SATA drive
- Export of imaged sector list was failing when CSV file became larger than 5 MB
- Empty image file could be created when imaging fails to start
- Few corner-case issues when using reverse imaging passes
Other fixes
- File selection dialog was showing E01 image size instead of real file size
- Diagnostics. Last significant work time interval was not always correct
- False detection of DCO max address limitation in rare cases
2019.7
Introduction of simple Web API with 5 commands:
- /start-image – launches an imaging session
- /check-task – returns the status of an imaging task
- /scan-devices – find all source drives available for imaging
- /stop-task – stops imaging session
- /help – opens API documentation
New system setting: Store shared folder logins and passwords in TaskForce
Case ID is now displayed in the device selection window.
- Target drive serial numbers were missing in imaging reports
- Restoring file image from password-protected network folder denied
- File selection window was too wide when open on mobile phone
- WrappedApiResultException when parsing partition with bad sectors
2019.4.1
May 14, 2019
- Imaging to a large non-compressed E01 file located on a target device sometimes interrupted due to a write error
- Very rare internal out-of-memory error when working with E01 files on target device
2019.4
- Imaging
- Image files can be created on exFAT-formatted target drives
- Support of imaging to E01 compressed files
- Imaging to E01. Performance increase by 100%.
- Imaging. Performance enhancement for SAS ports: 100-200% increase depending on the combination of source and target types
- Support of remote work folder to store case data on a network server
- Cases. New option Set case details before task start
- Diagnostics. Drive temperature graph and drive working timespans
- Wiping. The speed of random and LBA pattern methods accelerated by 100%
- New method of TaskForce firmware update: from USB stick
- Japanese language support
- E01 files. Partitions might not be found in other forensic tools (X-Ways, Encase)
- It was impossible to select an image file with “+” sign in its filename
- USB drives. Intermittent unsuccessful identification of certain USB drives
- INTEL SSDSC2KB240G7 solid-state drive model was not identifiable
- False Device isn't connected to TaskForce or is not responding message on certain enterprise SAS drives
- Diagnostics. Rare incorrect According to the status register, circuit board is malfunctioning message for drives on SAS ports
- Diagnostics. Estimated imaging time indication was missing for old drives with capacity below < 7 GB
- Diagnostics. Short circuit diagnosis could be missing when short circuit is detected.
2018.12
- NVMe support!
- Support of M.2, Thunderbolt, and Apple PCIe extension modules
- Imaging
- The option to image all sectors with data
Supported file systems: NTFS, APFS, Ext 2/3/4, HFS, HFS+, ExFAT, FAT16, FAT32
- Unclip HPA until power cycle on source drives
- Pause and Resume features support for pre-hash and post-hash calculation during imaging session
- SAS port. Performance increase by 25%
- Improved imaging of damaged drives
- New setting Save report in the target folder when imaging to a file
- E01 metadata automatically filled with case ID, investigator, description from the case management system
- User interface
- Fully revamped UI with center-aligned pages
- Better UI version for smartphones
- Short values (1K, 1M, 1G, 1T) supported in all LBA text boxes
Example: 3M will transform into 3,000,000
- 4K sector size support on SATA, SAS, USB drives
- Wiping. Added methods: NIST 800-88, DOD 5220, Random, LBA Number
- System menu. Added Release notes page and Toggle full screen feature
- USB devices. On certain devices, bad sectors were detected but not reported in the logs
- Warning when opening E01 file in Encase created by Atola TaskForce
- HPA/DCO indication missing on SATA devices plugged to SAS ports
- Issues identifying drives in PUIS mode
- Unclip HPA/DCO not working on IDE drives
- Several translation inaccuracies in the Chinese version
2018.8
- Imaging
- Overall performance increase by 25% when imaging to network shared folders
- Imaging presets with export/import features
- Export of imaged/non-imaged/error sectors into a file
- Sparse file support when writing into target images
- Improved damaged drive support for disks that freeze in the course of imaging
- Option to automatically limit target drive capacity to match that of the source via HPA
- Hashing. 100% performance increase of double-hash (MD5+SHA1) calculation reaching 650 MB/s
- Case management
- Export of one or multiple cases into a file
- Import of cases from a file
- Navigation between reports via new arrow buttons in the bottom panel
- Improvement in printing of multiple reports
- Diagnostics. Improved Media Surface check for solid-state drives
- SAS drives. SMART support
- SATA drives. Added PHY link in the bottom panel
- E01 metadata is now automatically filled from the corresponding case
- Imaging. Improved graph animation smoothness for large screen resolutions
- Imaging. After read error, error type was not showing in a corresponding log message
- Diagnostics. Removed incorrect error message for partitions larger than 8TB
- Issue when a task may not start when drive power is off
- E01 files. Invalid E01 metadata when non-Latin characters are used in Description and Investigator fields
- Issue with SATA drives in PUIS mode not getting identified in rare cases
- Multiple UI fixes
2018.1.3
- Imaging to password-protected servers and network folders
- Static IP mode for both 10Gbit Ethernet ports
2018.1.2
July 1, 2018
Chinese language support
2018.1.1
June 6, 2018
- Diagnose. Error when scanning a partition of more than 2TB size
- Activation. Intermittent error during the first system activation
- Fixed other minor issues