Atola TaskForce is designed to handle various types of image acquisition:
Use TaskForce’s 18 ports and leverage their configurability:
You can switch between Source and Target modes to configure the system, making it fit your needs. The Source mode is hardware write-protected.
Atola TaskForce allows imaging to up to 5 targets at a time at the top native speeds of the drives, and supporting data recovery from damaged media. TaskForce’s server-grade hardware allows running up to 6 SSD-to-SSD sessions with simultaneous hash calculation at the top native speeds of the drives. When it comes to HDD-to-HDD imaging, there is virtually no limit on the number of such sessions.
You have two key options for creating a file image:
Supported file images:
With TaskForce, you have two 10Gbit Ethernet ports at your disposal. We highly recommend using a 10Gbit network to transfer data to the server faster. Network speed, current network workload, write speed of server’s drives and other external factors affect TaskForce’s imaging performance.
Other ways to expedite imaging to network include:
The target must be configured to Storage mode for maging to a file on target drive. The drive is formatted to exFAT with 32 MB cluster size for improved performance. A target drive in Storage mode can be used for multiple images.
Atola TaskForce 2020.1 and subsequent firmware versions allow imaging to files on an encrypted target drive. An encrypted exFAT partition locked with your password is created on the target drive using VeraCrypt with a 256-bit AES algorithm. This helps securely store your images on media for transportation.
TaskForce creates an identical copy of the original evidence drive from an image file (E01, RAW, AFF4), in a forensically sound manner.
You can restore your source image file from anywhere:
With 2020.7 firmware the imager can assemble drives or image files (or a combination) into RAID arrays by automatically detecting their configuration. TaskForce creates a forensically sound image of the RAID’s separate volumes or the whole array.
The system takes advantage of RAID 5 redundancy to create a complete image of the array, which allows it to reassemble and image RAID 5 arrays with missing or damaged devices: when encountering a bad block on one of the RAID’s devices, the imager reads the corresponding blocks of other RAID drives or parity blocks to complete the missing data.
With your Atola TaskForce you can image selected partitions of a RAID array to expedite acquisition of critical evidence.
If time is critical, there is an even quicker option: imaging specific files & folders of RAID to logical L01 container.
This feature was added in the 2022.4 firmware update.