Express Mode

To tackle cases that involve many drives faster, TaskForce 2 forensic imager is enhanced with Express mode for self-launching imaging. When the mode is activated, every imaging session starts automatically upon plugging source drives into TaskForce 2.

Note: The video does not include target file templates that were added later in firmware 2024.9.

25 simultaneous imaging sessions

TaskForce 2 forensic imager can process up to 25 imaging sessions in Express mode on almost all of its Source ports:

  • 8 SATA
  • 8 SAS/SATA
  • 4 USB
  • 1 IDE
  • 4 NVMe M.2/U.2 PCIe 4.0

When activated, Express mode controls all source ports, leaving target ones available for other tasks.

Many evidence drives can be imaged simultaneously to RAW, E01, or AFF4 files located on a local server. To increase the data transfer rate, TaskForce 2 is equipped with two 10Gb Ethernet ports.

25 imaging sessions in progress.

25 imaging sessions in progress.

Drive port groups in Express mode

Combine any number of TaskForce ports into a custom group and assign different imaging settings for each group in Express mode:

  • Network folder where to save an image file
  • Which image file format to use
  • Which type of hash to calculate
  • Whether to diagnose the source device before imaging
  • How to fill in case report fields: Case ID, Organization, Investigator

For example, to balance evidence acquisition time, you can image new NVMe drives to your faster server and older/smaller SATA drives to a slower storage device. Or image healthy drives to the “Good” network folder and faulty ones to the “Bad” network folder to treat them differently later.

Specify different settings for a group of ports.

Specify different settings for a group of ports.

Express mode: Automated diagnostics

We recommend that users enable autostart of diagnostics before imaging in Express mode settings. A fully automated diagnostics module checks all drive subsystems: hard drive’s motor and electronics (PCB), head stack, media surface, all firmware/system areas, partitions, and file systems. Diagnostics provides several advantages:

  • information about drive state,
  • encrypted, existing, and lost partitions,
  • estimated imaging time for good drives,
  • recommendations for damaged drives.

As soon as you connect multiple source devices, TaskForce 2 automatically runs diagnostics and later launches individual imaging sessions.

Alternatively, you can ensure imaging of good drives only by selecting the Start imaging only if diagnostics has no issues option.

Pausing self-launch imaging. When TaskForce forensic imager detects a damaged drive. It lets you decide whether the start of imaging should be immediate or take place later, with a specific imaging approach based on the type of damage.

Express mode settings.

Express mode settings.