New stage 4 of RAID configuration autodetection starts in case
three initial stages were unsuccessful: automatic search of a
missing device in RAID 5.
- APFS support (unencrypted volumes only).
Improved RAID autodetection due to an enhanced file system
- Partition table in a tooltip for MBR device tag.
- APFS support, including encrypted volumes.
- ZIP file supported as a target logical container.
New Web API call: /start-logical – launches logical
imaging session to L01 or ZIP.
New button Check. Allows to check the specified file
filters and download the matched files as CSV.
Express mode: USB drives supported.
Wiping: New Format NVMe method for NVMe SSDs.
- AMA max address detection during firmware check.
- Shows APFS volumes and containers.
HPA, DCO, and AMA: Other tasks >
Hidden drive areas. New functionality enables changing and
unclipping of HPA, DCO, and AMA.
New user management system:
- It can be activated in System settings.
- Admin & User roles.
- Case access restrictions by user.
- Auto-lock screen with user password.
- One case can include multiple drives.
- Same drive can belong to multiple cases.
AFF4 image file reading and validation. Performance
increased by 120%.
Imaging: Adjacent single read errors in the logs are merged
into sector ranges. It makes log smaller when imaging a damaged
QR code added to ease TaskForce activation.
Imaging of WD_BLACK NVMe drives could not be started due to
underscore in the model name.
Incorrect behavior during Resume of a paused imaging session to an
image on a powered-off Storage drive.
Failed to open network shares with passwords containing several
special characters (e.g. ! , : “).
- Rare head check error possible on old IDE drives.
Rare specific error when reading SMART temperatures and not
showing the graph.
RAID: Too many Mirror tags when all devices have the same
Issue with FAT32 file extensions in Logical and Browse Files.
Logical imaging feature-set:
- 12+ parallel logical imaging sessions
- Ability to pause and continue each session
- L01 target images stored in the network or a destination drive
- Advanced logical image acquisition using include/exclude filters
- Supported file systems: NTFS, ext4/3/2, exFAT, XFS, HFS, HFS+, HFSX, FAT32/16
- SHA hash calculation performance increased by 50%, reaching 1GB/s speed now
- SHA-256 and SHA-512 calculation when imaging to E01 file. Hashes are stored in the
imaging report only.
- New Web API call: /report – downloads ZIP-file with imaging report, log and
additional CSV files if segmented hashes and file signatures enabled
- Reading NVMe source drive SMART attributes before and after imaging
- New stage 3 of RAID configuration detection (extended) added
- Better autodetection of RAID array with non-zero Start LBA
- Improved NTFS automatic validation
- Added explanatory tooltips for RAID tags: Spare, MBR
- NVMe drives supported
- Click on the ‘Diagnose’ button powers up and identifies drives by
- File system check. Partition labels are displayed now
New system settings:
- Show ‘Add case’ button on TaskForce top panel
- Set date and time automatically or manually
- Print settings moved to settings instead of popping up in a dialog after every Print
An improved user experience when printing multiple reports.
File manager. New ‘Create folder’ button.
Other -> View SMART. NVMe drive support.
System log improved to provide better TaskForce diagnostics and tech support.
Some SSD models could not be identified on SATA ports after power cycling TaskForce
It was impossible to parse an NTFS partition created on an external drive by Xbox One
NTFS parsing error for partitions with cluster size > 128KB
Incorrect capacity detection of WD MyBook 4TB USB drives
A missing detection hint after RAID auto assembly restart for an array created with
IP display could have an IP address missing in rare cases
Device page. Showing invalid Modified Dates of target image files on a Storage drive
A lengthy Case Description could cause reports to look buggy
- Live stats of file signatures
- Target HEX viewer with the imaged raw sector data displayed in real-time with a freeze option
- Fast RAID 10 imaging
- XFS support when imaging only sectors with data
- RAID 10 autodetection and group management
- XFS support
- Enhanced RAID autodetection algorithm
Diagnostics. USB drive supported
Other > Browse files. XFS supported in the file system preview
In Web API, /check-task query has a new result field: hashes
In reports and running tasks, the top right Case ID is clickable for identifiable devices
- Imaging could fail to start when switching settings from Linear hashing to Segmented hashing and disabling all hash types
- Few UI fixes of imaging presets
Some models of USB flash drives had an incorrect capacity
Rare case when opening network folders was too slow during image file selection
RAID-mounted drives could be mistakenly powered down when staying in idle mode for 5 minutes
Diagnostics. Invalid "The motor does not consume proper current on spinup. The motor may be stuck, or the circuit board is malfunctioning." diagnosis for SSDs with non-working PCB
File manager. "Create file" button was missing after unlocking a password-protected network folder
Express mode. "User action required" dialog was not showing for Resume and Retry imaging situations
It was impossible to set a non-Latin Case ID
- AFF4 image file support
- Imaging to compressed E01. Performance increased by 100%
- Detailed speed stats during imaging to reveal bottlenecks
- Manual jump when you click the imaging progress bar
Revamped imaging presets:
- New local presets which are saved in your browser
- Damaged drive preset
Multi-launch mode for Wipe, Hash, Diagnose and other single device
- exFAT support
- HFS/HFS+ support
- New wiping method: Secure Erase
- Option to automatically unclip HPA/DCO before wiping
Other > Browse Files - file browser for devices and images.
M.2 Extension. Support of NVMe drive hot-swap.
Support of HTTPS with external organizational and self-signed
Device status tag for quick display of the last diagnostics result
or lack thereof.
Image hash was not stored in E01 target file if a read error
Possible write error when imaging a 16TB+ drive to an
uncompressed E01 target image file
Imaging couldn’t launch if target directory had a comma (,)
character in its path
Inability to resume imaging to E01 compressed file if you pause
it during a read error
- Minor issues with reverse imaging mode and automatic jumps
- A slight deviation in free space calculation of Storage
RAID. Failed RAID configuration autodetection when facing NTFS
partition with filenames longer than 127 bytes.
Logs, Non-device reports, Information about the hardware unit's
components were not included when generating a large report from
- Improved RAID autodetection. Fine-tuned algorithms will narrow the possible configurations down to a single variant more frequently
- When multiple RAID assumptions are suggested, they are listed in the order of probability
- New Error tag is displayed if read errors are encountered during RAID autodetection. The tag's tooltip shows read error count
- Improved handling of a damaged drive when one of RAID devices freezes while reading sectors
- Memory use optimized for RAID autodetection involving more than 8 devices
- Maximum number of autochecked configurations increased from 500,000 to 100,000,000
- RAID 5. Ability to add a Missing Device and start another RAID autodetection
- RAID 5 based on mdadm. Automatic addition of a Missing Device
- Summary hint with recommendations is shown if RAID autodetection failed to find the right RAID configuration
Network setup + Imaging to server:
- DFS (Distributed File System) supported
- Connect dialog allows specifying a full network folder path
- New network settings: DNS nameserver, Default gateway
- Ability to work in networks having SMBv2 strictly disabled
- The following message was missing in the imaging log: Source device HPA was set to native max address until power cycle: 123,123,123
- Imaging could not be started if limiting the target device to source size by HPA failed
- Rare imaging interruption when attempting to start selective head imaging with some models of Toshiba drives
- Imaging (Hashing, Wiping, as well) could not be started against NetAPP SAS drives
- Disable read-look ahead setting was not working properly
- Resuming imaging for RAID wasn't possible after pausing imaging and changing the RAID configuration
- RAID. Serial numbers of selected devices were not always entirely visible on RAID configuration page
- RAID. Add devices buttons and Remove device area missing when using screen tablet with 6+ devices selected
- Storage drive automounting now works in Target mode only. Previously, it was running for both Source and Target modes.
- Fixed a few minor issues with case reports created for RAID devices
- Case import completed report might have no detailed information inside
- Autodetection of RAID configuration
- Convenient assembly with partition preview
- Supported RAID types: RAID 0, 1, 5 and JBOD
- Missing drive support in RAID 5
Supported file systems for RAID autodetection: NTFS, ext4/3/2
- Imaging assembled RAID array or its individual partitions
- Add, change and delete passes of a paused imaging session
E01 evidence number, investigator, description are added to the
final imaging report
- Ability to restore image file to 4Kn drive
Save report in the target folder option became enabled by
SAVE TO button on Reports page. Allows to quickly save
and export selected reports in a single ZIP file.
Remote work folder. Performance optimization for cases when 15+
tasks are running simultaneously.
- Improved report search for non-English languages
- Ability to reindex currently selected Work Folder
Support of SAS drives with sector size above 4096 sectors
UI changes on the device selection panel
Fast device actions: Power on/off, Reidentify, Unmount storage
- Device power indication
Home page. Specific port indicated for each device report
Imaging to E01 could not get started if source device’s serial
number was longer than 50 characters
Resuming imaging session could fail if target image folder is
Out of memory error while importing large work folder package
Possible minor issues with segmented hashes after imaging paused
Fixed HTML styling when a case report is opened outside
Seagate SSD 600 Pro drive was not detected in the device
Incorrect values of Last open date in Cases page
May 22, 2020
- Revamped Chinese texts
- Mistakes in Chinese and Japanese translations
March 26, 2020
Segmented hashes – an alternative to linear hashing. It will come in handy when dealing with damaged drives or providing enhanced resiliency against data corruption.
- TaskForce browser-cached data was not always refreshed after firmware update
- Target files with long Chinese/Japanese names could not be created
- Few minor issues when imaging into E01 files
February 27, 2020
E01 segmented files (E01, E02, etc) supported
Web API, /start-image call. New targetFile parameter allowing to customize target image file name
Auto-mount of VeraCrypt-encrypted Storage when its diagnostics completes
- Few minor issues when doing case import from Storage
- Cancel button was not working during case export
Create encrypted password-protected VeraCrypt volume on a target
drive to store images
Recent folder tiles in Device panel's File section to speed up target file location choice
- Optimization of TaskForce memory usage when imaging to E01
Visual checkmarks in reports to compare hashes during and after
- Case export to a USB stick or any other Storage
- Case import from a USB stick or any other Storage
- Deletion of cases and reports
User experience improvements:
- Revamped UI across the whole interface
- File browser: faster folder opening, cleaner look & feel
- More accessible smartphone UI
Support of SAS drives with non-standard sector sizes: 520, 528, 4080
Settings page shows MAC addresses of both TaskForce Ethernet ports
Web API, /check-task call:
New query parameter - source. Example:
- New result fields: source, completionDate
Manual is now built into TaskForce firmware
- Issue mounting Oracle ZFS NAS to store image files
It was impossible to select a network target folder with
password-protected Guest account
Small sector blocks were not visible in the imaging map progress
Possible E01 validation issue when selecting huge 10TB+ image
Occasional error when formatting a target drive to Storage with
FalseThe disk claims that it won't read multiple sectors at a time message in Diagnostics (rare case)
Cancel button wasn't properly working during the operations:
Identifying device, Creating target file, Checking source
- Express mode - a self-launching imaging mode. Plugging a source drive into port automatically
- Imaging by selected heads. Support for most of Seagate, WD, Hitachi, Toshiba models
- Suggestion to disable damaged/degraded heads when starting the first imaging session
- Detection of degraded and damaged heads
- By-head speed graphs
- Showing SMART’s Power on Time in human-readable form
- Automounting of Storage drives
- Imaging into more than one E01/Raw file on Storage
- Save report in the target folder option supported
- Showing available space and image files Storage drive contains
- Stricter check and confirmation request when someone attempts to wipe Storage
- Open file selection dialog after one clicks Storage in the device selection panel
- Ability to resume imaging session to compressed E01 located on Storage
Drive identification is now 3-4 times faster when you open the device selection panel
Support of damaged USB flash drives which are in read-only mode
Improved recognition of vendor-specific SMART attributes
- It was impossible to resume imaging session after target device write error
- Errors when writing USB drives with a capacity above 2 TB
- SATA drive plugged into SAS port could get paused after source drive hung up
- Possible errors when imaging 4kN SAS drive to 4kN SATA drive
- Export of imaged sector list was failing when CSV file became larger than 5 MB
- Empty image file could be created when imaging fails to start
- Few corner-case issues when using reverse imaging passes
- File selection dialog was showing E01 image size instead of real file size
- Diagnostics. Last significant work time interval was not always correct
- False detection of DCO max address limitation in rare cases
Introduction of simple Web API with 5 commands:
- /start-image – launches an imaging session
- /check-task – returns the status of an imaging task
- /scan-devices – find all source drives available for imaging
- /stop-task – stops imaging session
- /help – opens API documentation
New system setting: Store shared folder logins and passwords in TaskForce
Case ID is now displayed in the device selection window.
- Target drive serial numbers were missing in imaging reports
- Restoring file image from password-protected network folder denied
- File selection window was too wide when open on mobile phone
- WrappedApiResultException when parsing partition with bad sectors
May 14, 2019
- Imaging to a large non-compressed E01 file located on a target device sometimes interrupted due to a write error
- Very rare internal out-of-memory error when working with E01 files on target device
- Image files can be created on exFAT-formatted target drives
- Support of imaging to E01 compressed files
- Imaging to E01. Performance increase by 100%.
- Imaging. Performance enhancement for SAS ports: 100-200% increase depending on the combination of source and target types
- Support of remote work folder to store case data on a network server
- Cases. New option Set case details before task start
- Diagnostics. Drive temperature graph and drive working timespans
- Wiping. The speed of random and LBA pattern methods accelerated by 100%
- New method of TaskForce firmware update: from USB stick
- Japanese language support
- E01 files. Partitions might not be found in other forensic tools (X-Ways, Encase)
- It was impossible to select an image file with “+” sign in its filename
- USB drives. Intermittent unsuccessful identification of certain USB drives
- INTEL SSDSC2KB240G7 solid-state drive model was not identifiable
- False Device isn't connected to TaskForce or is not responding message on certain enterprise SAS drives
- Diagnostics. Rare incorrect According to the status register, circuit board is malfunctioning message for drives on SAS ports
- Diagnostics. Estimated imaging time indication was missing for old drives with capacity below < 7 GB
- Diagnostics. Short circuit diagnosis could be missing when short circuit is detected.
- NVMe support!
- Support of M.2, Thunderbolt, and Apple PCIe extension modules
- The option to image all sectors with data
Supported file systems: NTFS, APFS, ext2/3/4, HFS, HFS+, ExFAT, FAT16, FAT32
- Unclip HPA until power cycle on source drives
- Pause and Resume features support for pre-hash and post-hash calculation during imaging session
- SAS port. Performance increase by 25%
- Improved imaging of damaged drives
- New setting Save report in the target folder when imaging to a file
- E01 metadata automatically filled with case ID, investigator, description from the case management system
- User interface
- Fully revamped UI with center-aligned pages
- Better UI version for smartphones
- Short values (1K, 1M, 1G, 1T) supported in all LBA text boxes
Example: 3M will transform into 3,000,000
- 4K sector size support on SATA, SAS, USB drives
- Wiping. Added methods: NIST 800-88, DOD 5220, Random, LBA Number
- System menu. Added Release notes page and Toggle full screen feature
- USB devices. On certain devices, bad sectors were detected but not reported in the logs
- Warning when opening E01 file in Encase created by Atola TaskForce
- HPA/DCO indication missing on SATA devices plugged to SAS ports
- Issues identifying drives in PUIS mode
- Unclip HPA/DCO not working on IDE drives
- Several translation inaccuracies in the Chinese version
- Overall performance increase by 25% when imaging to network shared folders
- Imaging presets with export/import features
- Export of imaged/non-imaged/error sectors into a file
- Sparse file support when writing into target images
- Improved damaged drive support for disks that freeze in the course of imaging
- Option to automatically limit target drive capacity to match that of the source via HPA
- Hashing. 100% performance increase of double-hash (MD5+SHA1) calculation reaching 650 MB/s
- Case management
- Export of one or multiple cases into a file
- Import of cases from a file
- Navigation between reports via new arrow buttons in the bottom panel
- Improvement in printing of multiple reports
- Diagnostics. Improved Media Surface check for solid-state drives
- SAS drives. SMART support
- SATA drives. Added PHY link in the bottom panel
- E01 metadata is now automatically filled from the corresponding case
- Imaging. Improved graph animation smoothness for large screen resolutions
- Imaging. After read error, error type was not showing in a corresponding log message
- Diagnostics. Removed incorrect error message for partitions larger than 8TB
- Issue when a task may not start when drive power is off
- E01 files. Invalid E01 metadata when non-Latin characters are used in Description and Investigator fields
- Issue with SATA drives in PUIS mode not getting identified in rare cases
- Multiple UI fixes
- Imaging to password-protected servers and network folders
- Static IP mode for both 10Gbit Ethernet ports
July 1, 2018
Chinese language support
June 6, 2018
- Diagnose. Error when scanning a partition of more than 2TB size
- Activation. Intermittent error during the first system activation
- Fixed other minor issues