Express Mode
To tackle cases that involves many drives faster, TaskForce forensic imager is enhanced with Express mode for self-launching imaging. When the mode is activated, every imaging session starts automatically upon plugging source drives into TaskForce.
17 simultaneous imaging sessions
TaskForce forensic imager can process up to 17 imaging sessions in Express mode on almost all of its Source ports:
- 6 SATA
- 6 SATA/SAS
- 4 USB
- IDE
When activated, Express mode controls all source ports, leaving target ones available for other tasks.
Many evidence drives can be imaged simultaneously to E01 or RAW files located on a local server. To increase data transfer rate, TaskForce is equipped with two 10Gb Ethernet ports.
17 imaging sessions in progress
Express mode: Automated diagnostics
We recommend that users enable autostart of diagnostics before imaging in Express mode settings. A fully-automated diagnostics module checks all drive subsystems: hard drive’s motor and electronics (PCB), head stack, media surface, all firmware/system areas, partitions, and file systems. Diagnostics provides a number of advantages
- information about drive state
- encrypted, existing and lost partitions
- estimated imaging time for good drives
- recommendations for damaged drives
As soon as you connect multiple source devices, TaskForce automatically runs diagnostics and later launches individual imaging sessions.
Alternatively, you can ensure imaging of good drives only by selecting Start imaging only if diagnostics has no issues setting.
Pausing self-launch imaging. When TaskForce forensic imager detects a damaged drive. It allows deciding whether start of imaging should be immediate or take place later, with a specific imaging approach based on the type of damage.
Express mode settings