The operation of most evidence acquisition tools is based upon the assumption that everything is fine. This approach works, until the hard drive stops in the middle of the imaging session, and in a few hours you have to conclude: the evidence drive is dead.
Atola TaskForce can automatically diagnose a hard drive (its electronics, motor, heads, media surface, firmware, file systems) to identify the exact reason of failure and suggest the best imaging approach.
Atola TaskForce can accurately diagnose evidence drives that cannot be identified/recognized by any system. In cases where Atola TaskForce can’t identify the hard drive, it can still diagnose the device by sensing the SATA PHY status, sending low-level, vendor-specific commands into the HDD, and interpreting electrical currents.
Atola TaskForce applies power to the hard drive, while immediately starting to sample its startup currents. The next step: comparing the startup currents to the internal database, thus detecting a specific failure.
This very approach allows to successfully identify a range of defects: head stack failure, motor damage, electronic board damage, etc.
Atola TaskForce's automatic diagnostics evaluates the state of the hard drive, identifies specific errors and recommends steps for data recovery and extraction. The operator simply plugs the damaged hard drive into the TaskForce unit and clicks a single button to start automatic checkup. Real-time status updates are displayed throughout the diagnostics. Full diagnostic report is generated in under 3 minutes.
This engine identifies damage in the following areas:
Usually, Atola TaskForce identifies multiple failures at once. In some cases, though, only one failure will show up during the first diagnostics. Other issues will come up during the recovery process.
For example, if a hard drive fails in both the PCB and firmware area, only PCB damage will be identified at first. And this is because the PCB is responsible for relaying electrical signals from the hard drive to detect firmware damage. Once the PCB is repaired, the hard drive has to be diagnosed for the second time to identify the damage to the firmware area.
Attempts to read sectors with a damaged head add a lot of time to the imaging process and can cause further damage to the hard drive. Diagnostics helps to identify the damage to the headstack and pinpoint which heads are damaged.
TaskForce smartly prompts to disable a particular damaged or degraded head. Once the operator clicks “yes”, the system automatically disables the head. If the user clicks “no” the degraded head can still be disabled manually in the imaging settings.
Physical head swap is always a challenge. Certain hard drive designs make the process extremely complicated, and in some cases, donor parts can be very difficult or even impossible to acquire. Physical recovery cases can be time consuming and expensive, head-by-head imaging can often save an operator the need to attempt a head swap.