Sources & Targets
Atola TaskForce is designed to handle various types of image acquisition:
- drive-to-drive
- drive-to-network
- file-to-drive
- RAID reassembly and image acquisition
- imaging to a file on a target drive
- imaging to a file on an encrypted target drive
Multiple imaging sessions in action
Use TaskForce’s 18 ports and leverage their configurability:
- 6 SATA
- 6 SATA/SAS
- 4 USB
- IDE
- Extension port (for Thunderbolt/Firewire, M.2 SSD including NVMe, Apple PCIe SSD devices).
You can switch between Source and Target modes to configure the system, making it fit your needs. The Source mode is hardware write-protected.
Drive-to-drive imaging
Atola TaskForce allows imaging to up to 5 targets at a time at the top native speeds of the drives, and supporting data recovery from damaged media. TaskForce’s server-grade hardware allows running up to 6 SSD-to-SSD sessions with simultaneous hash calculation at the top native speeds of the drives. When it comes to HDD-to-HDD imaging, there is virtually no limit on the number of such sessions.
Drive-to-drive imaging
Drive-to-file imaging
You have two key options for creating a file image:
- Imaging to a network server
- Imaging to a target drive
Supported file images:
- E01
- AFF4
- RAW (DD, IMG)
- L01 (in case of logical imaging)
Drive-to-file imaging: E01, AFF4, DD, IMG, RAW.
Imaging to a file on a network server
With TaskForce, you have two 10Gbit Ethernet ports at your disposal. We highly recommend using a 10Gbit network to transfer data to the server faster. Network speed, current network workload, write speed of server’s drives and other external factors affect TaskForce’s imaging performance.
Other ways to expedite imaging to network include:
- Imaging to a sparse file (if the server's file system supports sparse files): TaskForce optimizes saving of sector ranges containing binary zeroes, which helps saving both space and time.
- Imaging to a compressed file: If the evidence drive’s partitions are unencrypted, imaging to a E01 file with on-the-fly E01 chunks compression is easily handled by TaskForce’s robust server-grade Xeon CPU;
- Imaging to a RAW target file: when it comes to a severely damaged drive, this is the best option; the imaging engine uses the multi-pass system and its smart settings.
Imaging to a file on target drive
The target must be configured to Storage mode for maging to a file on target drive. The drive is formatted to exFAT with 32 MB cluster size for improved performance. A target drive in Storage mode can be used for multiple images.
Imaging to a file on target drive
Atola TaskForce 2020.1 and subsequent firmware versions allow imaging to files on an encrypted target drive. An encrypted exFAT partition locked with your password is created on the target drive using VeraCrypt with a 256-bit AES algorithm. This helps securely store your images on media for transportation.
File-to-drive imaging
TaskForce creates an identical copy of the original evidence drive from an image file (E01, RAW, AFF4), in a forensically sound manner.
You can restore your source image file from anywhere:
- Network shared folder
- NAS
- Encrypted or unencrypted target drive (Storage)
Selecting file as a source for imaging.
RAID image acquisition
With 2020.7 firmware the imager can assemble drives or image files (or a combination) into RAID arrays by automatically detecting their configuration. TaskForce creates a forensically sound image of the RAID’s separate volumes or the whole array.
The system takes advantage of RAID 5 redundancy to create a complete image of the array, which allows it to reassemble and image RAID 5 arrays with missing or damaged devices: when encountering a bad block on one of the RAID’s devices, the imager reads the corresponding blocks of other RAID drives or parity blocks to complete the missing data.
RAID image acquisition
With your Atola TaskForce you can image selected partitions of a RAID array to expedite acquisition of critical evidence.
If time is critical, there is an even quicker option: imaging specific files & folders of RAID to logical L01 container.
This feature was added in the 2022.4 firmware update.