Imaging selected partitions of a RAID array
With Atola TaskForce, you can image individual partitions of an assembled RAID array to avoid imaging excessive amounts of data.
Once the RAID array has been reassembled, you can preview the contents of its partitions. It helps you conclude which of the partitions may contain the critical evidence and which are irrelevant.
The suggested RAID configuration applied, partitions preview shows partitions
1. Click Go to Image button
2. Select your target device and click Continue.
3. Go to the settings and click the imaging pass to adjust the imaging range
The suggested RAID configuration applied, partitions preview shows partitions
4. A pop-up window with pass settings will open. In What to image drop-down menu, select Sectors with data
Click Sectors with data
5. Unselect the partitions you do not need and click Save to keep this change
Select partitions for imaging
Please note the selective imaging does not linear hashing of the imaged range, segmeted hashing is suggested for such imaging.
6. Click Start to launch your imaging session
The suggested RAID configuration applied, partitions preview shows partitions
Imaging report
Atola TaskForce will generate Imaging completed report with all the details of the RAID:
- The imaged range
- Time stamps
- A link to the file with the segmented hash, calculated for the imaged range
The Imaging completed report
