Call us: 10am – 6pm ET

888 540-2010, 416 833-3501

FAQ

Imaging


Can I image a RAID array that contains a damaged drive?

RAID assembly module requires good, readable drives to find a configuration. When one of the RAID's drives is damaged, it's best to image the drive and attempt the reassembly using the image. However, if the configuration is known and no search is required, you can try to mount the RAID even with a malfunctioning device. Just specify the configuration manually and proceed with imaging. TaskForce's 5-pass imaging engine handles RAID arrays with such issues effectively.

If you are dealing with RAID 5 or RAID 1, TaskForce will use the RAID's redundancy when encountering internal read errors.

Please note that when one of the drives in a RAID 5 array is seriously damaged, you can add a virtual Missing device instead of the damaged device. Next, it is possible to reassemble and image the RAID 5 array from the remaining healthy drives and 1 "stub" device. TaskForce can reconstruct data from such arrays on-the-fly in the course of imaging.


How do I clone a drive and create multiple identical copies?

TaskForce is perfectly suited for cloning! Here is how to clone into 4 SATA drives and 1 RAW file simultaneously.

If you need to create multiple copies, simply:

  1. Click the Image icon in the left sidebar
  2. Select your evidence drive in the Select source device slideout panel
  3. Select up to 5 targets (SATA, USB, SAS or RAW, E01 files) in the Select target device slideout panel
  4. Click the Start button.

What's more, TaskForce has 18 ports in total including IDE and Extension ports in combination with huge overhead capacity to handle many more imaging sessions or other operations. So if you start a 1-to-5 cloning, you still have 12 ports left for additional cloning/imaging sessions to run simultaneously. TaskForce was designed to minimize the total imaging time.


How do I set up an automated launch of AXIOM after imaging?

You cannot launch a third-party software from TaskForce itself. However, there are automation tools that allow TaskForce to be integrated into a workflow with Magnet AXIOM. For instance, Magnet AUTOMATE. Atola team closely cooperates with Magnet's developers to support and enhance this integration. This is how it works.

Another option is a folder monitor/watchdog. It can be an app that tracks whether a new image file appears in a specific folder. After that, it can trigger to launch Magnet AXIOM against the newly created image. There are many watchdog tools on the web. Here's an example.

How do I image to an E01 or a RAW file?

When selecting targets in the slide-out panel, click the Select file tile. It only works if TaskForce is connected to a network and there is at least one freely accessible network folder available.

The panel contains How to connect link that explains steps to setup Windows network share. One may also set up a network folder in Linux: we tested this with modern versions of Ubuntu and CentOS.


How can I create an E01 image?

Start an imaging session:

  1. Click Image in the left-side menu
  2. Select a source drive in the left slideout panel
  3. Click Select File in the right slideout panel
  4. In the file navigator, click Create File button
  5. Fill in E01 details or leave the default values. Click Create
  6. Click Continue

Is there a way to delete an imaging session and start imaging all over again?

When you select source and target drives that were previously used in an imaging session, TaskForce will show indicate the progress status of the previous session and you will be allowed to resume it. To start a new imaging session, you will need to delete the previous one:

  1. Click the Image button in the left sidebar
  2. Select the source and the target
  3. Right-click the imaging session (or tap it with 2 fingers if you are using a touch screen)
  4. Click Allow imaging map deletion in the drop-down menu. A Trash icon will appear in each imaging session tile.
  5. Click the Trash icon to delete the previous imaging session. Now you are able to start a new session to the same target.

To disable imaging map deletion, click/tap the imaging session again and select the option in the drop-down menu.



Performance


How to reach 15 TB/h?

TaskForce was designed as the ultimate multitasking tool with huge overhead capacity. Given that most imaged devices are HDDs, whose data transfer rate is 200 - 220 MB/s at best, it is not frequently that you will be seeing TaskForce reaching the limits of its capacity.

Our QA team achieves the speed of 15 TB/hour with this very specific setup:

  • imaging 6 SAS ports to 6 SATA ports (all SSD drives)
  • imaging 2 USB ports to 2 USB ports (all SSD drives)
  • imaging NVMe extension port to a network file (10 Gbit connection)
  • imaging IDE port (with an IDE drive attached) to a network file (10 Gbit connection)

This adds up to 10 imaging sessions at superb overall performance.

However, in most cases, you deal with HDDs as source devices, and they are half as fast as SSDs, which creates a bottleneck.

Another potential performance bottleneck is network bandwidth. To achieve maximum throughput, link ETH1 port to one network or NAS, and the other, ETH2 port to another network or NAS. It will give you 20Gb/s in theory. In practice, it depends on your network hardware and setup. To learn about network throughput optimization, please read the official TaskForce manual:

Performance when imaging to a remote USB drive (write cache + exFAT)

There are two ways to boost imaging performance:

  1. Format the target drive to exFAT. It works faster than NTFS
  2. Enable Windows write cache:
    • To do that, go to Device Manager
    • Select your drive in Disk Drives category
    • Switch to Better performance in Policies tab
    • Confirm the reboot of the PC

Important: When the last imaging session completes, use Eject Removable media icon in the system tray to guarantee cache-flushing of the last portions of written data. Here is an article explaining how it works.



Connectivity


How do I extend my server network with a DHCP-enabled switch

Here is an example of switch that supports static IP setup via simple web admin. To set the IP addresses for each current server network node:

Ubiquiiti EdgeSwitch 16 XG
Four 10Gbit Ethernet ports, twelve 10Gbit SFP ports
Approximate price: $600

To configure a Ubiquiti DHCP server:

  1. Connect PC and TaskForce to Ubiquiti switch
  2. Set static IP address of PC to 192.168.1.4
  3. Open a browser and enter 192.168.1.2 (default Ubiquiti switch IP)
  4. Log in with default credentials: ubnt (both name and password)
  5. Go to System > Advanced Configuration > DHCP server > Global.
  6. Activate Admin mode by checking a necessary checkbox and pressing Submit button.
  7. Go to Pool Summary and press Add to make a new address pool
  8. Enter your:
    - pool name
    - network base address (192.168.1.0 for example)
    - network mask (255.255.255.0)
    - put Default Router Address and DNS

    After creating your pool, you can change it via "Pool configuration" tab.

  9. Click Save configuration button in the right upper corner of the window and click Save.

Alternatively, there is an tutorial on Youtube.

To enable 10Gbit with jumbo frames:

  1. Go to Basic > Port summary
  2. Select ports 0/13, 0/14, 0/15, 0/16 and click Edit
  3. Change Maximum Frame Size to 9014 in Edit Port configuration window

There is no DHCP server on our internal lab network. How do I give TaskForce a static IP address?

  1. In TaskForce, click the menu button in the top right corner
  2. Click Settings
  3. In the Network section, you will find IP settings for both 10Gbit Ethernet cards
  4. Click pencil button to see Use static IP checkbox

Atola TaskForce demo video includes basic explanation of the network settings. Here's a Youtube timelink on that.

How do I set up Windows Server share?

In Control panel:

  1. Enable Guest account (Administrative tools - AD users and computers - Users)
  2. Next, go to Network and sharing center - Change advanced sharing settings - Turn On network discovery + Turn on sharing (file and printers + public folders)
  3. In the shared folder access options, add Guest or Everyone

If the shared folder demands restricted access, please follow this guide.

How do I connect TaskForce to a network domain?

TaskForce does not require a preliminary setup for working in a domain. Instead, your flow would be:

  1. Click the Image icon on the left panel
  2. Select source
  3. While selecting target, click Select file
  4. In the file manager's Local network section, click Connect button
  5. New dialog will appear with the Domain field

The entered server will remain in the Local Network section list.

Additionally, in Web API, there's a targetFolderDomain parameter of /start-image command that may be of use.

How do I setup Synology DS218?

  1. Go to Control panel > File services > SMB > Advanced settings
  2. Set Maximum protocol to SMB3
  3. Go to Control panel > Shared folder
  4. Click Create button and specify network folder details

If you need to get a guest account working, run the next actions:

  1. Go to Control panel > User
  2. Edit for Guest user
  3. Untick Disable this account

How do I connect a mouse and a keyboard to the Surface tablet?

  1. Exit full-screen mode by tapping menu in the top right corner and selecting Toggle Full Screen
  2. Enable Bluetooth in the tablet's Windows 10
  3. Connect the mouse and keyboard

Case management & reports


Can reports only be exported in PDF, can I export them into RTF format instead?

It should be possible to save a page into RTF. For example, in this Chrome AddOn you can select the reports and click Print, it will generate a single page with all selected reports, which can be exported to .RTF file.


Can all reports listed in the main page be sorted, managed or deleted?

Yes, they can be filtered, sorted, exported and deleted. The quickest way to perform a search is by using the Search field above the reports on the main page. Entering task name (Image, Diagnose, Wipe) and/or device model/serial allows running quick searches.

To sort, export, or delete reports, you can go to Reports in the top menu, where all case reports are shown in a table view. SAVE TO helps download the selected reports in a single ZIP file. There is also a DELETE button in the bottom right corner for your needs.

How can I export reports in Standalone mode?

You can use an external USB drive for it. To proceed, it must be formatted as a TaskForce-compatible Storage device.
Here is how you do it:

  1. Plug USB drive into one of USB ports
  2. Switch the USB port into target mode (turn off its Source switch)
  3. Click Devices and then click the File tile
  4. In Select image file window, click the Add storage button.
  5. In Select device panel click the drive you want to use in the Storage mode.
  6. Choose Format device to exFAT and click Next
  7. Click Format and confirm the action

Once the USB device has been formatted as a Storage, you can use it as a target device to save reports on in Standalone mode:

  1. Plug the USB Storage device into any USB port
  2. Go to Cases
  3. Search for the cases you need. Use the search field and sortable table to locate the cases
  4. Select the cases
  5. Click the Export button
  6. Select Storage plugged into TaskForce
  7. Click the Export button.

Hardware


For information sensitivity reasons, my organization needs any storage or wireless transmission devices to be removed from forensic imagers. How do I remove or replace the internal storage from the unit?

We have foreseen that such requirement may be imposed by some organizations. That's why TaskForce allows the following:

  • units assembled in 2020 onwards WiFi module is no longer built in
  • built-in WiFi (in units assembed in 2018 - 2019) is disabled by default and can be removed if necessary (through the hatch in the lid)
  • the tablet's camera and mic are disabled during assembly
  • the touchscreen is detachable (the imager can be operated without a screen)
  • removable internal SSD

How can I protect my TaskForce from physical damage during transportation?

From September 2020 onwards, all newly assembled units are equipped with a magnetic screen cover that is included in the standard package with the product. This cover helps protect the unit's screen, it is easily attached and removed when necessary. If you need a pelican case to pack the unit with all the cables and extensions, the suitable case model is IM-2700. For instructions on how to obtain a fitted foam, please contact our support.

Where can I purchase additional SAS and SATA cables?

eSATAp cables similar to the ones included in the package with TaskForce can be ordered on Amazon or a different online shopping site (Ebay, AliExpress, etc.) at around $9 each. The SAS/SATA powered cables are not widely available on the market - this custom cable is made per our order.

Is there a battery to keep my TaskForce powered when there is a no electric grid available?

These Cyberpower UPS systems can serve as a reliable battery for Atola imagers, TaskForce and Insight alike:

The flat horizontal UPS design is convenient as it allows putting an Atola imager on top of it. The price range of CyberPower UPS systems is quite vast, and you can choose a suitable model with power ranging from 500VA/300W to 2000VA/2000W.

Subscription


How do I activate my unit in a network-free environment?

There is a single way to perform TaskForce activation or subscription extension:

  1. Enter the TaskForce serial number. It can be found at the bottom of the unit
  2. TaskForce generates a license key (Internet connection is not required)
  3. You find an Internet-connected PC and visit the website: a.atola.com
  4. You enter the license key and several other details
  5. The website generates a TaskForce activation code
  6. You write the code down or take a photo, and then enter it in TaskForce activation screen