Creating an E01 file on a target drive
By putting a target device in Storage mode, TaskForce enables the creation of multiple image files (E01, RAW, img or dd) on the target drive.
To set a target device to Storage mode:
1.Go to Home page;
2. Click Image button in the left-side taskbar;
3. Select the source drive;
4. In Select target devices panel click Select file.
Select target
5. In Select image file window click Add storage button.
Add a storage drive
6. In the Select device panel click the drive you want to use in Storage mode. Please note that TaskForce uses a lighter shade of blue to indicate that a storage drive is being configured.
Select a storage drive
If TaskForce cannot find the appropriate exFAT partition on the drive selected, it will offer you to format the device accordingly.
Format the target to exFAT
7. By clicking Yes you agree to launching target device formatting to exFat with a large cluster size (32 MB). This cluster size will enable faster imaging to this drive.
Format the target to exFAT
Once the target device is formatted, TaskForce perceives it as a Storage target.
The drive in Storage mode is marked with a special blue icon in the device panel.
A drive in Storage mode
To proceed with creating a compressed E01 image file on this device:
1.Click the storage drive and then the + Create file button;
Add a new file
2. In Create image file pop-up window, enter the name and select the type of the image file.
Create a file
3. Click the Create button to fill E01 file information.
4. Tick the Combox next to Compressed E01 option and fill out the form with file details. Then click Create.
Configure the compressed E01 file
5. Check your imaging settings and click Start to proceed with imaging by clicking the Start button.
Check imaging settings
NB When you select compressed E01 option in the imaging settings, the multi-pass imaging system or reverse imaging option cannot be applied to such an imaging session. However, other fine-tuning options remain available including advanced hashing options (pre-hash, post-hash, Segmented hashing, etc.) and selective imaging.
The Imaging completed report provides all the time stamps, hash values and hash verification result. To look up the settings of the imaging session, you can also see the Imaging started report in the case management system.
Imaging completed
