Atola TaskForce has a multi-pass imaging engine, developed using our decades-long experience in data recovery. This imaging hardware system enables forensic evidence acquisition even from physically damaged HDDs, while protecting the media from further deterioration.
To handle damaged drives in the most gentle and thorough way, Atola TaskForce includes these features:
Multi-pass imaging uses large blocks with short timeouts on the first few passes, scheduling reads inside slow areas for later. And then using the smallest block size on the last pass when fewer sectors are left to be read.
This technique helps achieve imaging max speeds in good areas of the drive. At the same time, it allows approaching bad areas in the most delicate way possible and retrieving as much data as possible.
Often the drive is unable to read data from the damaged sectors and goes into a long-lasting retry mode before it gives up on a particular sector and returns an error.
To avoid causing further damage to the data on the drive and long waiting periods, TaskForce issues a reset command whenever a drive attempts to read a block of sectors longer than allowed by the pre-configured timeout. And later Atola hard drive imaging hardware continues retrieving data from the next planned block on the drive.
If retry mode last despite two reset commands, TaskForce will perform power cycle command by forcibly cutting power to the drive for 5 seconds. And then will continue imaging from the next planned block. If the second power cycle does not help either, imaging will be terminated.
If the diagnostics report shows that a part of drive’s head stack is damaged, this hard drive imaging hardware tool provide the possibility to select good heads only to be imaged during an imaging session. This function helps avoid further damage to the healthy parts of the drive by disabling the damaged head.
With this function selected, TaskForce will approach skipped areas of the drive from the other side on any selected pass.
This way, the imaging module can retrieve more data from a drive before entering a damaged zone, which needs to be concentrated on during the following passes.
Most contemporary hard drives have read look-ahead functionality, which makes the drive read more blocks sequentially than requested by software.
In good drives, this functionality helps the drive operate faster by reading more data and caching it.
But with bad drives, read look-ahead leads to bad areas being addressed more often. This slows down the process and may lead to a complete freeze of the drive. In such cases, disabling read look-ahead option is advisable.
With bad drives, the fewer times you read data on them, the longer they will last. This can be critical for bringing a criminal to justice in the court of law.
It is therefore advisable that when imaging a damaged drive, hash calculation is done simultaneously with imaging. This way, TaskForce only reads the data on the drive once.
When dealing with a damaged hard drive, we strongly recommend using segmented hashing. This method supports multi-pass imaging and handling of bad sectors and provides better resiliency against data corruption.
Block sizes and timeouts for each source drive read operation are adjustable. The default settings of the passes are optimized based on our vast experience in data recovery market to fit most problematic hard drives and other types of storage media. Therefore, it is advisable to follow them, unless a particular drive requires specific settings.
Each hard drive has a SMART table that gives information about its health. The worse the values in the SMART table, the more carefully the drive needs to be treated.
To evaluate how quickly a bad drive’s condition is getting worse, a user of Atola TaskForce can track critical changes in drive’s health.
To do that, TaskForce can compare the SMART table before and after imaging and highlight any differences.
TaskForce has two presets called Default and Damaged, recommended for good and faulty drives respectively.
To approach bad drives in the most gentle way possible, TaskForce uses its special multi-pass imaging system.
To thoroughly retrieve maximum data from an unstable drive in a forensically sound way with a minimal downtime, the preset for damaged hard drives has several major differences from default imaging settings: