Restore E01, AFF4, RAW image file to drive
To restore data from an image file to a drive using Atola TaskForce, follow these steps:
- Click the Image icon in the left-side taskbar of Atola TaskForce
- To select a file as your source go to File tab of the Select source device panel and click Select file
- Select the E01, AFF4 or RAW file you are planning to restore
- Select the target drive and click Continue:
NB: If your target drive is larger than the size of the image, the hash values of the target drive will not be identical to that of the image file. With Atola TaskForce, you can limit a SATA target drive's capacity via Host Protected Area (HPA) or Accessible Max Address (AMA). Applying the HPA or AMA will set a new max address in the drive’s firmware, which will make the sectors beyond the required capacity inaccessible. This will make the hashing process straightforward and the hashes will match.
To limit SATA target drive's capacity via HPA/AMA, go to the imaging Settings and click the Change button.
Go to the Miscellaneous tab and enable the Limit target disk size to source size using HPA/AMA option.
- Click Start for the imaging to begin.
Atola TaskForce automatically creates detailed reports for every session. The imaging report will list all the details of the source, the target, the imaging settings and timestamps including the setting of the new max address of the target drive. This makes such data extraction from a file transparent and forensically sound.
