By putting a target device in Storage mode, TaskForce enables the creation of multiple image files (E01, RAW, img or dd) on the target drive.
To set a target device to Storage mode:
1.Go to Home page;
2. Click Image button in the left-side taskbar;
3. Select the source drive;
4. In Select target devices panel click Select file.
5. In Select image file window click Add storage button.
6. In the Select device panel click the drive you want to use in Storage mode. Please note that TaskForce uses a lighter shade of blue to indicate that a storage drive is being configured.
If TaskForce cannot find the appropriate exFAT partition on the drive selected, it will offer you to format the device accordingly.
7. By clicking Yes you agree to launching target device formatting to exFat with a large cluster size (32 MB). This cluster size will enable faster imaging to this drive.
Once the target device is formatted, TaskForce perceives it as a Storage target.
The drive in Storage mode is marked with a special blue icon in the device panel.
To proceed with creating a compressed E01 image file on this device:
1.Click the storage drive and then the + Create file button;
2. In Create image file pop-up window, enter the name and select the type of the image file.
3. Click the Create button to fill E01 file information.
4. Tick the Combox next to Compressed E01 option and fill out the form with file details. Then click Create.
5. Check your imaging settings and click Start to proceed with imaging by clicking the Start button.
NB When you select compressed E01 option in the imaging settings, the multi-pass imaging system or reverse imaging option cannot be applied to such an imaging session. However, other fine-tuning options remain available including advanced hashing options (pre-hash, post-hash, Segmented hashing, etc.) and selective imaging.
The Imaging completed report provides all the time stamps, hash values and hash verification result. To look up the settings of the imaging session, you can also see the Imaging started report in the case management system.