Imaging cheat sheet

AFF4 image, RAW image file, or target drive plugged into the unit. Best to use segmented hashing with linear hashing disabled.

E01 is a linear format. It limits the use of TaskForce's advanced imaging features, e.g. reverse imaging or manual jumps.

Imaging with linear hash: one MD5/SHA1 hash.

Imaging with segmented hashes: many hashes of corresponding LBA ranges of the image.

The sum of these LBA ranges represents the entire image, though not necessarily in sequential order. You can still prove that the entire image has not been modified by verifying all hashes in a set.

If Diagnostics detects a damaged or degraded head, disable the head in the imaging settings for the initial imaging session.

Read more here: Imaging a drive with a damaged head.

Use high-quality short USB3 cables. Longer or lower-quality USB3 cables can produce read errors during imaging.

Imaging pass setting.

When enabled, the imaging engine reads a drive backwards.

Pros:

• disables Read Look-Ahead effect
• reaches damaged areas from the opposite direction

Cons:

• speed decreases due to auto disabling of drive's cache

Imaging pass setting.

When enabled, a source device switches off its read-cache. Disabling read look-ahead decreases speed; but, it can be helpful against damaged drives.

The last pass has a unique feature which does not occur during previous passes: internal auto-reread procedure for error block sector-by-sector. It is defined by an unchangeable Jump size = 1 sector.

How imaging engine works on the last pass:

1. It reads block using Max Block Size pass setting (256 by default)
2. If reading is successful -> proceed to a next non-imaged block
3. If a read error occurs -> re-read the whole error block sector by sector.
4. If a read error occurs and ReadLong setting is enabled -> re-read using ReadLong command.

How it is useful:

1. Make sure the drive is in good condition or learn about the type of damage to make an informed decision about your following steps.
2. Prioritize the drive. Diagnostics report tells you if there is any data at all.
3. Use imaging time estimation.

Good options:

• target SSD
• target NAS
• network server with RAID

When imaging a network, 10Gbit network connection is highly recommended.

• Time-constrained scenarios
• Large capacity drives (e.g., 10TB and above) or RAID arrays
• When specific files are of interest, not the entire drive

Image output format will be L01 or zip.

You can read the data from your source device with a different timeout by adding another pass to your imaging session when it’s paused:

1. Pause the currently running imaging, using the Pause button.
2. Click Image and select your Source device.
3. On the Recent imaging sessions page, find your paused session and click the Edit imaging settings icon next to it.
4. In the Imaging settings dialog, click Add pass.
5. Click on the new pass, edit the Timeout value and Save it.
6. Select the new pass, click Go to Pass and Apply.
7. Next to your paused session, click the Resume button.

Important: The resumed imaging session will complement the data imaged prior to the pause with only the sectors that were not yet copied.

Express mode is ideal for processing large amounts of data quickly. It automatically starts an imaging session for a newly inserted drive:

1. In the TaskForce window, go to system Menu > Express mode.
2. Specify Express mode Settings and click Activate.
3. Plug devices into Source ports: SATA, SAS, USB, IDE.
4. Imaging will start automatically.
5. If imaging doesn't start and the corresponding front LED is off, check the Home screen.

Web API helps external software to communicate with TaskForce. Another software may control TaskForce this way. To put it simply, there are simple operations in TaskForce Web API that any external software can run:

• Get available Source drives
• Optionally: diagnose drives
• Start imaging
• Check task status
• Stop running task (if necessary)
• Download created report