TaskForce 2 Changelog

Imaging

Target file templates in physical and logical imaging. Create reusable templates that help the following:

• dynamically create destination folders based on date or other info
• filename generation according to your naming convention
• enter the same file/case details for many images

Improved user experience when imaging to files. Target files are located on a separate tab of the selection panel.

Imaging of high-entropy (encrypted or compressed) data to E01 compressed file uses a new rapid adaptive method resulting in optimization:

• 30-80% speed increase depending on network speed and/or target drive write performance
• TaskForce CPU load reduction from 35% to 10% (per one imaging session)

New optimized Deflate method for imaging of compressible data to E01.

New Global Settings

• Show the date and time instead of the Atola logo at the top bar
• Autofill source case data and/or E01/AFF4/L01 metadata.
• Save system logs into the work folder.

RAID: New Select all checkbox when selecting multiple drive images as RAID members.

SMART: Improved recognition of vendor-specific SMART attributes for SSD drives.

Logical Imaging

• The task might stop with an out-of-memory error when there are over 3.5 million files.
• Symbolic files of NTFS partitions were omitted.
• OS Folders filter wasn’t working.

Imaging

• A folder with HTML report could not be created on the Storage drive if the folder path contained dots.
• False ‘Insufficient space on target device’ log message in rare cases.
• When imaging a damaged drive, TaskForce's system log contained too much redundant technical information.

Diagnostics: False firmware check failure for SD cards connected via MCA1307 SATA to SD card adapter.

Global Settings: It was possible to enter zero value in the min field of the Automatically lock screen setting.

Case Management: Enabled “Information about unit's components” had no effect when printing a single report.

In Kiosk mode, the Chrome browser might request downloading updates.

SMART could not be read for several SAS drive models.

RAID:

• Full automatic reassembly and imaging support of Synology NAS RAID.
• New Layout tab to visualize selected RAID configuration.
• Autodetection module: New Start LBA parameter to specify RAID offset used by autodetection (Gear button).
• Improved memory use and performance optimizations.
• Expand/Collapse buttons for RAID configuration and Partitions panels to improve UX.

Imaging:

• Improved capability to resume imaging in case of power or network connection loss.
• BitLocker volume GUID added to the imaging log.
• Post-hash mode with Segmented hashes creates a CSV file in addition to the performed verification.

Express Mode Imaging

• Port groups: Ability to image some ports to one folder with specific settings and other ports to another with other settings. Multiple groups supported.
• AFF4 added as selectable imaging target.
• New settings: Case ID, Organization, Investigator.

Logical Imaging:

• Wildcards (*, ?) support in file/folder filters.
• Check button enabled for reassembled RAID when autodetection is still running.

System-wide Btrfs support.

System-wide LVM (Logical Volume Manager) support.

Web API:

• Ability to use API when user management system activated.
• New POST call /login.
• New GET call /diagnose.

Diagnose - File System Stage:

• Added analysis of ext4/3/2, XFS, HFS+, HFSX.
• BitLocker volume detection with FVE Metadata blocks.

Case Management:

• New window to select an existing case to improve UX.
• New global setting ‘Set default values for all cases’: Fills in default values for Investigator, Organization, Location for all new cases.
• New global setting ‘Show empty case values in report header’.
• New global setting ‘Automatically create a sub-folder with the same name as target image file name’.

Many page headers now link to articles about using TaskForce from the offline manual.

Kiosk mode: The offline manual from the main menu opens in a dialog.

New Hints subsystem displays practical hints to expedite work with TaskForce based on behavior. Hints appear as notifications once, and all can be found in the hint list.

Improved handling of situations where source drive unplugged before starting a task.

Improved recognition of vendor-specific SMART attributes.

LEDs change their state when the firmware boots or updates.

New Blink LED operation for each port.

New Ethernet bonding mode for ETH1 and ETH2 ports.

Unable to identify USB Seagate One Touch drives.

Imaging:

• Next imaging pass with reverse direction could not start if a source drive had bad sectors during the previous pass.
• Incorrect XFS partition size when its allocation group size was different during imaging partitions.
• Rare visual representation issue with the imaging map graph could result in empty gaps after multiple page refreshes.

RAID: Some exFAT partitions may not open in Partitions tab due to incorrect internal caching.

Diagnose:

• In Multi-launch mode, it could not start when one of selected drives is not detected.
• IDE drives with working Verify but non-working Read commands could be classified as degraded instead of damaged.
• ‘Unknown device’ in case report header for drives with corrupted firmware.

Web API: /start-image call could not find the built-in Damaged imaging settings.

Possible case report duplication after connection loss and recovery with a remote Work Folder.

Invalid behavior when attempting to start a task against a damaged device with zero byte capacity.

SMART: For NVMe drives, the start page had a description of ATA specification attributes.