Accurately assessing the state of a hard drive and finding the exact points of damage will determine the approach taken to successfully complete the data acquisition.
With traditional forensic tools you never really know the true state of the media you work with. This means that most data acquisitions are based on an assumption that everything is fine.
This approach works most of the time, until you have a case where the hard drive just stops working in the middle of an imaging session, and after a few hours of poking around you have to conclude: that evidence drive is dead.
Atola TaskForce is the only commercially available tool that can automatically diagnose a hard drive and pinpoint the exact failure (if any), and suggest the best course of action.
The tool automatically diagnoses hard disk electronics, motor, heads, media surface, firmware, and even file systems, and provides a clean and easy to read report.
The Atola TaskForce is able to accurately diagnose hard drives that cannot be recognized or identified by any system including the vast majority of disk imaging, data recovery, and data acquisition products, even the most sophisticated ones. In cases where the Atola TaskForce cannot recognize the hard drive, it can still diagnose the drive by sensing the SATA PHY status, sending low-level, vendor-specific commands into the HDD, and interpreting electrical currents.
Here's how this works: Atola TaskForce applies power to the hard drive and immediately starts sampling its startup currents. Then, comparing the startup currents to the internal database it can detect a specific failure.
Virtually any defect can be successfully diagnosed using this approach: head stack failure, motor damage, electronic board damage, etc. Since the method relies solely on start-up currents and nothing else, the hard drive does not have to be operational for successful diagnosis.
The Atola TaskForce's automatic diagnostics function evaluates the state of the hard drive, identifies specific errors and then recommends steps for moving forward with HDD recovery and data extraction. This is the starting point for all data recovery or acquisition cases. The operator simply plugs the damaged hard drive into the DiskSense unit and clicks a single button to start the automatic checkup. Real-time status updates are displayed throughout the diagnosis and a full diagnostic report is then generated in less than 5 minutes.
This engine identifies damage in the following areas:
In data recovery, it is quite common for a hard drive to have multiple issues. In some cases, the Atola TaskForce will identify multiple failures at once. In others cases, only one failure will show up during the first diagnosis and further issues will become visible as the recovery process goes on.
For example, if a hard drive has experienced failure in both the PCB and firmware area, only the damage in the PCB will be identified at first because the PCB is needed to relay electrical signals from the hard drive in order to detect firmware damage. Once the PCB is repaired, the HDD will need to be diagnosed a second time in order to identify the damage to the firmware area.
Trying to read sectors with a damaged head adds a lot of time to the process and can cause more damage to the hard drive. To avoid this, diagnostics helps to identify damage to the headstack and pinpoint which specific heads are damaged.
TaskForce smartly prompts to disable a particular damaged or degraded head. Once the operator clicks yes, the system automatically disables the head. If the user clicks no the degraded head can still be disabled manually in the imaging settings.
Physical head swap is always a challenge. Certain hard drive designs make the process extremely complicated, and in some cases, donor parts can be very difficult or even impossible to acquire. Whatever the case, physical recovery cases can be time consuming and expensive, and being able to image head-by-head can often save an operator the need to attempt a head swap.
The ability to image by specific heads gives forensic investigators using Atola TaskForce a significant technical advantage.