Call us: 10am – 6pm ET

888 540-2010, 416 833-3501

Sources & Targets

Atola TaskForce is designed to handle various types of image acquisition:.

Use TaskForce’s 18 ports and leverage their configurability:

You can switch between Source and Target modes to configure the system, making it fit your needs. The Source mode is hardware write-protected.

Drive-to-drive imaging

Atola TaskForce allows imaging to up to 5 targets at a time at the top native speeds of the drives, and supporting data recovery from damaged media. TaskForce’s server-grade hardware allows running up to 6 SSD-to-SSD sessions with simultaneous hash calculation at the top native speeds of the drives. When it comes to HDD-to-HDD imaging, there is virtually no limit on the number of such sessions.

Drive-to-file imaging

You have two key options for creating a file image:

Supported file images:

Imaging to a file on a network server

With TaskForce, you have two 10Gbit Ethernet ports at your disposal. We highly recommend using a 10Gbit network to transfer data to the server faster. Network speed, current network workload, write speed of server’s drives and other external factors affect TaskForce’s imaging performance.

Other ways to expedite imaging to network include:

  1. Imaging to a sparse file (if the server's file system supports sparse files): TaskForce optimizes saving of sector ranges containing binary zeroes, which helps saving both space and time.
  2. Imaging to a compressed file: If the evidence drive’s partitions are unencrypted, imaging to a E01 file with on-the-fly E01 chunks compression is easily handled by TaskForce’s robust server-grade Xeon CPU;
  3. Imaging to a RAW target file: when it comes to a severely damaged drive, this is the best option; the imaging engine uses the multi-pass system and its smart settings.

Imaging to a file on target drive

The target must be configured to Storage mode for maging to a file on target drive. The drive is formatted to exFAT with 32 MB cluster size for improved performance. A target drive in Storage mode can be used for multiple images.

Atola TaskForce 2020.1 and subsequent firmware versions allow imaging to files on an encrypted target drive. An encrypted exFAT partition locked with your password is created on the target drive using VeraCrypt with a 256-bit AES algorithm. This helps securely store your images on media for transportation.

File-to-drive imaging

TaskForce creates an identical copy of the original evidence drive from an image file (E01, RAW, AFF4), in a forensically sound manner.

You can locate your source file anywhere:

RAID image acquisition

With 2020.7 firmware the imager can assemble drives or image files (or a combination) into RAID arrays by automatically detecting their configuration. TaskForce creates a forensically sound image of the RAID’s separate volumes or the whole array.

The system takes advantage of RAID 5 redundancy to create a complete image of the array, which allows it to reassemble and image RAID 5 arrays with missing or damaged devices: when encountering a bad block on one of the RAID’s devices, the imager reads the corresponding blocks of other RAID drives or parity blocks to complete the missing data.

With your Atola TaskForce you can image selected partitions of a RAID array to expedite acquisition of critical evidence.