TaskForce Changelog
2024.9
Imaging
Target file templates in physical and logical imaging. Create reusable templates that help the following:
-
dynamically create destination folders based on date or
other info
-
filename generation according to your naming convention
- enter the same file/case details for many images
Improved user experience when imaging to files. Target files are
located on a separate tab of the selection panel.
Imaging of high-entropy (encrypted or compressed) data to E01
compressed file uses a new
rapid adaptive method resulting in optimization:
-
100-200% speed increase depending on network speed
and/or target drive write performance
-
TaskForce CPU load reduction from 60% to 22% (per
one imaging session)
New optimized Deflate method for imaging of compressible data to E01.
New Global Settings
-
Show the date and time instead of the Atola logo at the top bar
- Autofill source case data and/or E01/AFF4/L01 metadata.
- Save system logs into the work folder.
Network setup: New Advanced section in the connection dialog
that allows specifying Samba protocol version and mount options for
network folders.
SSD Trim: Added support for NVMe drives via the Dataset
Management command with Deallocate option.
RAID: New Select all checkbox when selecting multiple drive
images as RAID members.
SMART: Improved recognition of vendor-specific SMART
attributes for SSD drives.
Bugfixes
Logical Imaging
-
The task might stop with an out-of-memory error when there are
over 3.5 million files.
- Symbolic files of NTFS partitions were omitted.
- OS Folders filter wasn’t working.
Imaging
-
A folder with HTML report could not be created on the Storage
drive if the folder path contained dots.
-
False ‘Insufficient space on target device’ log message in
rare cases.
-
When imaging a damaged drive, TaskForce's system log
contained too much redundant technical information.
Diagnostics:
False firmware check failure for SD cards connected via
MCA1307 SATA to SD card adapter.
Global Settings: It was possible to enter zero value in the min field of the
Automatically lock screen setting.
Case Management:
Enabled “Information about unit's components” had no effect
when printing a single report.
2024.6.1
July 11, 2024
Bugfix
Gateway IP address wasn't working in 2024.6 firmware having TaskForce connected to multiple subnets.
2024.6
RAID:
-
Full automatic reassembly and imaging support of Synology
NAS RAID.
-
New Layout tab to visualize selected RAID configuration.
-
Autodetection module: New Start LBA parameter to specify
RAID offset used by autodetection (Gear button).
- Improved memory use and performance optimizations.
-
Expand/Collapse buttons for RAID configuration and
Partitions panels to improve UX.
Imaging:
-
Improved capability to resume imaging in case of power or
network connection loss.
- BitLocker volume GUID added to the imaging log.
-
Post-hash mode with Segmented hashes creates a CSV file in
addition to the performed verification.
Express Mode Imaging
-
Port groups: Ability to image some ports to one folder with
specific settings and other ports to another with other
settings. Multiple groups supported.
- AFF4 added as selectable imaging target.
- New settings: Case ID, Organization, Investigator.
Logical Imaging:
- Wildcards (*, ?) support in file/folder filters.
-
Check button enabled for reassembled RAID when autodetection
is still running.
System-wide Btrfs support.
System-wide LVM (Logical Volume Manager) support.
Web API:
-
Ability to use API when user management system activated.
- New POST call /login.
- New GET call /diagnose.
Diagnose - File System Stage:
- Added analysis of ext4/3/2, XFS, HFS+, HFSX.
- BitLocker volume detection with FVE Metadata blocks.
Case Management:
- New window to select an existing case to improve UX.
-
New global setting ‘Set default values for all cases’: Fills
in default values for Investigator, Organization, Location
for all new cases.
-
New global setting ‘Show empty case values in report
header’.
-
New global setting ‘Automatically create a sub-folder with
the same name as target image file name’.
Many page headers now link to articles about using TaskForce
from the offline manual.
Standalone mode: The offline manual from the main menu
opens in a dialog.
New Hints subsystem displays practical hints to expedite
work with TaskForce based on behavior. Hints appear as
notifications once, and all can be found in the hint list.
Improved handling of situations where source drive unplugged
before starting a task.
Improved recognition of vendor-specific SMART attributes.
Bugfixes
Unable to identify USB Seagate One Touch drives.
Imaging:
-
Next imaging pass with reverse direction could not
start if a source drive had bad sectors during the
previous pass.
-
Incorrect XFS partition size when its allocation
group size was different during imaging partitions.
-
Rare visual representation issue with the imaging
map graph could result in empty gaps after multiple
page refreshes.
RAID: Some exFAT partitions may not open in Partitions tab
due to incorrect internal caching.
Diagnose:
-
In Multi-launch mode, it could not start when one of
selected drives is not detected.
-
IDE drives with working Verify but non-working Read
commands could be classified as degraded instead of
damaged.
-
‘Unknown device’ in case report header for drives
with corrupted firmware.
Web API: /start-image call could not find the built-in
Damaged imaging settings.
Possible case report duplication after connection loss and
recovery with a remote Work Folder.
Invalid behavior when attempting to start a task against a
damaged device with zero byte capacity.
SMART: For NVMe drives, the start page had a description of
ATA specification attributes.
2024.1
Verify segmented hashes - new task in the Other section. It helps check the segmented hashes in CSV file created during
imaging for any type of target: E01, AFF4, raw image, drive.
System settings:
-
Automatically create a subfolder using the target file name option.
If enabled, the target image will be created in a subfolder of a selected target folder.
-
Clear local and session storage button.
Any settings or temporary data stored in Chrome for the TaskForce web application will be permanently deleted.
Clickable device header in a case report. It opens the device information page if the appropriate device or image is available.
Bugfixes
Failed to open E01 files created by UFS Explorer.
Logical imaging. Check > Download was not handling comas in a generated file name list properly, which broke CSV format.
Reports. Possible first blank page when selecting a report from the list to print.
Minor fix of Other > Customize taskbar and Browse Files
compatibility.
2023.11
Customization of the Taskbar and Other page.
Bugfixes
Logical imaging:
- Task could freeze when imaging compressed files from APFS partitions.
- Rare case of “File was skipped due to reading” error with NTFS file system.
About 10 missing Chinese and Japanese translations.
2023.10
RAID:
- Automatic detection of unknown RAID 6 configuration.
- Full RAID 6 reassembly and imaging support.
- RAID 6 imaging speed is 40% higher than imaging of individual RAID members.
- RAID autodetection improvements for other RAID types.
- Maximum number of auto-checked configurations increased from 100,000,000 to 200,000,000.
- Advanced detection of partition types and display of device tags.
- MBR/GPT table information when hovering over the corresponding device tag.
Imaging:
- Check network speed test when selecting a folder for a target image. Click the three-dot button to see the test icon.
- Autosave of imaging progress to resume imaging in case of power or network connection loss.
- Storage. Ability to create multiple subfolders.
- Improved calculation of Estimated time left during imaging.
- Decreased frequency of Speed refresh when facing bad sectors.
- Detailed speed stats indicate more information when imaging to multiple files with identical names in different folders.
NVMe drives:
- New Status bar showing live drive state, including its temperature.
- Diagnostics. Added table of power states, PCIe generation, temperature levels.
- Device page. Added Critical and Warning temperature values.
- Wiping. New method Sanitize from NVM 1.4 specification.
Case management:
- Case contains a list of target images and drives used with a source drive.
- New setting ‘Allow non-unique case names’.
- Ability to delete device from case.
- New report ‘Device was added to case’.
Other > SSD Trim – new task that helps to notify SSD controller about unused blocks.
Other > View SMART. Apple PCIe and M.2 AHCI PCIe drives supported.
Global Settings. For the ETH1 and ETH2 ports, it shows the speed of the network connection.
Bugfixes
No access to network folder with underscore character in hostname.
Widely improved error-handling when someone accidentally unplugs source or target drive during imaging.
Imaging:
- Imaging could not start when the source was an image file with read-only permissions.
- Imaging could not start when a target drive was powered off.
- Unable to resume imaging after connection loss with network Work Folder.
Logical imaging:
- Some old HFS partitions failed to open.
- Resume button did not work for imported case with a logical imaging session created on another TaskForce.
RAID. Applying detected mdadm configuration was not removing Spare drive(s).
Wiping. Multi-launch mode. Format NVM method was mistakenly available for SATA drives.
Case management. Impossible to select the same case for the same Macbook after reconnection.
TOSHIBA MG08ACA16TE drives were not identified until the 2nd attempt.
Occasional error when formatting a target drive to Storage with exFAT.
UI issue on the home page. Blank space when running multiple tasks and scrolling down the page.
2023.4.2
Possible out of memory error when imaging 10+ TB source drive to E01 compressed segmented files.
1 or 2 files/folders were missing from the list when connecting to a network shared Windows drive folder (root folder only!).
Gateway address with static IP did not work when TaskForce was connected to multiple subnets.
2023.4
Settings:
- Added work folder speed test when network share is selected.
- Clicking Reset button will require YES-word confirmation now.
Faster opening of home page when running 10+ tasks.
Improved recovery when network connection with remote Work Folder temporarily disappears.
Optimized internal RAM memory use.
Bugfixes
In rare cases, Chrome browser could lose connection with TaskForce.
Eventual slow UI response by TaskForce when using this low-performance setup:
- 1 Gbit network
- Remote TaskForce work folder on a network share
- Imaging to files on the same network share
Logical. Resume of logical imaging could fail when having multiple sessions paused.
Minor UI fixes.
2022.10
RAID:
-
New stage 4 of RAID configuration autodetection starts in case
three initial stages were unsuccessful: automatic search of a
missing device in RAID 5.
- APFS support (unencrypted volumes only).
-
Improved RAID autodetection due to an enhanced file system
validation algorithm.
- Partition table in a tooltip for MBR device tag.
Logical imaging:
- APFS support, including encrypted volumes.
- ZIP file supported as a target logical container.
-
New Web API call: /start-logical – launches logical
imaging session to L01 or ZIP.
-
New button Check. Allows to check the specified file
filters and download the matched files as CSV.
Express mode: USB drives supported.
Wiping: New Format NVMe method for NVMe SSDs.
Diagnostics:
- AMA max address detection during firmware check.
- Shows APFS volumes and containers.
HPA, DCO, and AMA: Other tasks >
Hidden drive areas. New functionality enables changing and
unclipping of HPA, DCO, and AMA.
New user management system:
- It can be activated in System settings.
- Admin & User roles.
- Case access restrictions by user.
- Auto-lock screen with user password.
Case management:
- One case can include multiple drives.
- Same drive can belong to multiple cases.
AFF4 image file reading and validation. Performance
increased by 120%.
Imaging: Adjacent single read errors in the logs are merged
into sector ranges. It makes log smaller when imaging a damaged
drive.
QR code added to ease TaskForce activation.
Bugfixes
Imaging of WD_BLACK NVMe drives could not be started due to
underscore in the model name.
Incorrect behavior during Resume of a paused imaging session to an
image on a powered-off Storage drive.
Failed to open network shares with passwords containing several
special characters (e.g. ! , : “).
Diagnostics:
- Rare head check error possible on old IDE drives.
-
Rare specific error when reading SMART temperatures and not
showing the graph.
RAID: Too many Mirror tags when all devices have the same
data.
Issue with FAT32 file extensions in Logical and Browse Files.
2022.4
Logical imaging feature-set:
- 12+ parallel logical imaging sessions
- Ability to pause and continue each session
- L01 target images stored in the network or a destination drive
- Advanced logical image acquisition using include/exclude filters
- Supported file systems: NTFS, ext4/3/2, exFAT, XFS, HFS, HFS+, HFSX, FAT32/16
Imaging:
- SHA hash calculation performance increased by 50%, reaching 1GB/s speed now
- SHA-256 and SHA-512 calculation when imaging to E01 file. Hashes are stored in the
imaging report only.
- New Web API call: /report – downloads ZIP-file with imaging report, log and
additional CSV files if segmented hashes and file signatures enabled
- Reading NVMe source drive SMART attributes before and after imaging
RAID:
- New stage 3 of RAID configuration detection (extended) added
- Better autodetection of RAID array with non-zero Start LBA
- Improved NTFS automatic validation
- Added explanatory tooltips for RAID tags: Spare, MBR
Diagnostics:
- NVMe drives supported
- Click on the ‘Diagnose’ button powers up and identifies drives by
default
- File system check. Partition labels are displayed now
New system settings:
- Show ‘Add case’ button on TaskForce top panel
- Set date and time automatically or manually
- Print settings moved to settings instead of popping up in a dialog after every Print
action
An improved user experience when printing multiple reports.
File manager. New ‘Create folder’ button.
Other -> View SMART. NVMe drive support.
System log improved to provide better TaskForce diagnostics and tech support.
Bugfixes
Some SSD models could not be identified on SATA ports after power cycling TaskForce
It was impossible to parse an NTFS partition created on an external drive by Xbox One
S
NTFS parsing error for partitions with cluster size > 128KB
Incorrect capacity detection of WD MyBook 4TB USB drives
A missing detection hint after RAID auto assembly restart for an array created with
mdadm
IP display could have an IP address missing in rare cases
Device page. Showing invalid Modified Dates of target image files on a Storage drive
A lengthy Case Description could cause reports to look buggy
2021.8
Imaging:
- Live stats of file signatures
- Target HEX viewer with the imaged raw sector data displayed in real-time with a freeze option
- Fast RAID 10 imaging
- XFS support when imaging only sectors with data
RAID:
- RAID 10 autodetection and group management
- XFS support
- Enhanced RAID autodetection algorithm
Diagnostics. USB drive supported
Other > Browse files. XFS supported in the file system preview
In Web API, /check-task query has a new result field: hashes
In reports and running tasks, the top right Case ID is clickable for identifiable devices
Bugfixes
Imaging:
- Imaging could fail to start when switching settings from Linear hashing to Segmented hashing and disabling all hash types
- Few UI fixes of imaging presets
Some models of USB flash drives had an incorrect capacity
Rare case when opening network folders was too slow during image file selection
RAID-mounted drives could be mistakenly powered down when staying in idle mode for 5 minutes
Diagnostics. Invalid "The motor does not consume proper current on spinup. The motor may be stuck, or the circuit board is malfunctioning." diagnosis for SSDs with non-working PCB
File manager. "Create file" button was missing after unlocking a password-protected network folder
Express mode. "User action required" dialog was not showing for Resume and Retry imaging situations
It was impossible to set a non-Latin Case ID
2021.4
Imaging:
- AFF4 image file support
- Imaging to compressed E01. Performance increased by 100%
- Detailed speed stats during imaging to reveal bottlenecks
- Manual jump when you click the imaging progress bar
-
Revamped imaging presets:
- New local presets which are saved in your browser
- Damaged drive preset
Multi-launch mode for Wipe, Hash, Diagnose and other single device
tasks.
RAID:
- exFAT support
- HFS/HFS+ support
Wiping:
- New wiping method: Secure Erase
- Option to automatically unclip HPA/DCO before wiping
Other > Browse Files - file browser for devices and images.
M.2 Extension. Support of NVMe drive hot-swap.
Support of HTTPS with external organizational and self-signed
certificates.
Device status tag for quick display of the last diagnostics result
or lack thereof.
Bugfixes
Imaging:
-
Image hash was not stored in E01 target file if a read error
occurred
-
Possible write error when imaging a 16TB+ drive to an
uncompressed E01 target image file
-
Imaging couldn’t launch if target directory had a comma (,)
character in its path
-
Inability to resume imaging to E01 compressed file if you pause
it during a read error
- Minor issues with reverse imaging mode and automatic jumps
- A slight deviation in free space calculation of Storage
RAID. Failed RAID configuration autodetection when facing NTFS
partition with filenames longer than 127 bytes.
Logs, Non-device reports, Information about the hardware unit's
components were not included when generating a large report from
multiple cases.
2020.7.1
RAID:
- Improved RAID autodetection. Fine-tuned algorithms will narrow the possible configurations down to a single variant more frequently
- When multiple RAID assumptions are suggested, they are listed in the order of probability
- New Error tag is displayed if read errors are encountered during RAID autodetection. The tag's tooltip shows read error count
- Improved handling of a damaged drive when one of RAID devices freezes while reading sectors
- Memory use optimized for RAID autodetection involving more than 8 devices
- Maximum number of autochecked configurations increased from 500,000 to 100,000,000
- RAID 5. Ability to add a Missing Device and start another RAID autodetection
- RAID 5 based on mdadm. Automatic addition of a Missing Device
- Summary hint with recommendations is shown if RAID autodetection failed to find the right RAID configuration
Network setup + Imaging to server:
- Connect dialog allows specifying a full network folder path
- New network settings: DNS nameserver, Default gateway
- Ability to work in networks having SMBv2 strictly disabled
Bugfixes
Imaging:
- The following message was missing in the imaging log: Source device HPA was set to native max address until power cycle: 123,123,123
- Imaging could not be started if limiting the target device to source size by HPA failed
- Rare imaging interruption when attempting to start selective head imaging with some models of Toshiba drives
- Imaging (Hashing, Wiping, as well) could not be started against NetAPP SAS drives
- Disable read-look ahead setting was not working properly
- Resuming imaging for RAID wasn't possible after pausing imaging and changing the RAID configuration
Other fixes:
- RAID. Serial numbers of selected devices were not always entirely visible on RAID configuration page
- RAID. Add devices buttons and Remove device area missing when using screen tablet with 6+ devices selected
- Storage drive automounting now works in Target mode only. Previously, it was running for both Source and Target modes.
- Fixed a few minor issues with case reports created for RAID devices
- Case import completed report might have no detailed information inside
2020.7
RAID support:
- Autodetection of RAID configuration
- Convenient assembly with partition preview
- Supported RAID types: RAID 0, 1, 5 and JBOD
- Missing drive support in RAID 5
-
Supported file systems for RAID autodetection: NTFS, ext4/3/2
Imaging:
- Imaging assembled RAID array or its individual partitions
- Add, change and delete passes of a paused imaging session
-
E01 evidence number, investigator, description are added to the
final imaging report
- Ability to restore image file to 4Kn drive
-
Save report in the target folder option became enabled by
default
Case management:
-
SAVE TO button on Reports page. Allows to quickly save
and export selected reports in a single ZIP file.
-
Remote work folder. Performance optimization for cases when 15+
tasks are running simultaneously.
- Improved report search for non-English languages
- Ability to reindex currently selected Work Folder
Support of SAS drives with sector size above 4096 sectors
UI changes on the device selection panel
-
Fast device actions: Power on/off, Reidentify, Unmount storage
- Device power indication
Home page. Specific port indicated for each device report
Bugfixes
-
Imaging to E01 could not get started if source device’s serial
number was longer than 50 characters
-
Resuming imaging session could fail if target image folder is
password-protected
-
Out of memory error while importing large work folder package
files
-
Possible minor issues with segmented hashes after imaging paused
and resumed
-
Fixed HTML styling when a case report is opened outside
TaskForce
-
Seagate SSD 600 Pro drive was not detected in the device
selection panel
-
Incorrect values of Last open date in Cases page
2020.3.1
May 22, 2020
- Revamped Chinese texts
- Mistakes in Chinese and Japanese translations
2020.3
March 26, 2020
Imaging:
Segmented hashes – an alternative to linear hashing. It will come in handy when dealing with damaged drives or providing enhanced resiliency against data corruption.
Bugfixes
- TaskForce browser-cached data was not always refreshed after firmware update
- Target files with long Chinese/Japanese names could not be created
- Few minor issues when imaging into E01 files
2020.2
February 27, 2020
Imaging:
-
E01 segmented files (E01, E02, etc) supported
-
Web API, /start-image call. New targetFile parameter allowing to customize target image file name
Auto-mount of VeraCrypt-encrypted Storage when its diagnostics completes
Bugfixes
- Few minor issues when doing case import from Storage
- Cancel button was not working during case export
2020.1
Imaging:
-
Create encrypted password-protected VeraCrypt volume on a target
drive to store images
-
Recent folder tiles in Device panel's File section to speed up target file location choice
- Optimization of TaskForce memory usage when imaging to E01
-
Visual checkmarks in reports to compare hashes during and after
imaging
Case management:
- Case export to a USB stick or any other Storage
- Case import from a USB stick or any other Storage
- Deletion of cases and reports
User experience improvements:
- Revamped UI across the whole interface
- File browser: faster folder opening, cleaner look & feel
- More accessible smartphone UI
Support of SAS drives with non-standard sector sizes: 520, 528, 4080
bytes, etc
Settings page shows MAC addresses of both TaskForce Ethernet ports
Web API, /check-task call:
-
New query parameter - source. Example:
/api/check-task?source=SATA5
- New result fields: source, completionDate
Manual is now built into TaskForce firmware
Bugfixes
Imaging:
- Issue mounting Oracle ZFS NAS to store image files
-
It was impossible to select a network target folder with
password-protected Guest account
-
Small sector blocks were not visible in the imaging map progress
bar
Other fixes:
-
Possible E01 validation issue when selecting huge 10TB+ image
-
Occasional error when formatting a target drive to Storage with
exFAT
-
FalseThe disk claims that it won't read multiple sectors at a time message in Diagnostics (rare case)
-
Cancel button wasn't properly working during the operations:
Identifying device, Creating target file, Checking source
device
2019.9
Imaging
- Express mode - a self-launching imaging mode. Plugging a source drive into port automatically
starts
imaging process
- Imaging by selected heads. Support for most of Seagate, WD, Hitachi, Toshiba models
- Suggestion to disable damaged/degraded heads when starting the first imaging session
Diagnostics
- Detection of degraded and damaged heads
- By-head speed graphs
- Showing SMART’s Power on Time in human-readable form
Storages
- Automounting of Storage drives
- Imaging into more than one E01/Raw file on Storage
- Save report in the target folder option supported
- Showing available space and image files Storage drive contains
- Stricter check and confirmation request when someone attempts to wipe Storage
- Open file selection dialog after one clicks Storage in the device selection panel
- Ability to resume imaging session to compressed E01 located on Storage
Drive identification is now 3-4 times faster when you open the device selection panel
Support of damaged USB flash drives which are in read-only mode
Improved recognition of vendor-specific SMART attributes
Bugfixes
Imaging
- It was impossible to resume imaging session after target device write error
- Errors when writing USB drives with a capacity above 2 TB
- SATA drive plugged into SAS port could get paused after source drive hung up
- Possible errors when imaging 4kN SAS drive to 4kN SATA drive
- Export of imaged sector list was failing when CSV file became larger than 5 MB
- Empty image file could be created when imaging fails to start
- Few corner-case issues when using reverse imaging passes
Other fixes
- File selection dialog was showing E01 image size instead of real file size
- Diagnostics. Last significant work time interval was not always correct
- False detection of DCO max address limitation in rare cases
2019.7
Introduction of simple Web API with 5 commands:
- /start-image – launches an imaging session
- /check-task – returns the status of an imaging task
- /scan-devices – find all source drives available for imaging
- /stop-task – stops imaging session
- /help – opens API documentation
New system setting: Store shared folder logins and passwords in TaskForce
Case ID is now displayed in the device selection window.
- Target drive serial numbers were missing in imaging reports
- Restoring file image from password-protected network folder denied
- File selection window was too wide when open on mobile phone
- WrappedApiResultException when parsing partition with bad sectors
2019.4.1
May 14, 2019
- Imaging to a large non-compressed E01 file located on a target device sometimes interrupted due to a write error
- Very rare internal out-of-memory error when working with E01 files on target device
2019.4
- Imaging
- Image files can be created on exFAT-formatted target drives
- Support of imaging to E01 compressed files
- Imaging to E01. Performance increase by 100%.
- Imaging. Performance enhancement for SAS ports: 100-200% increase depending on the combination of source and target types
- Support of remote work folder to store case data on a network server
- Cases. New option Set case details before task start
- Diagnostics. Drive temperature graph and drive working timespans
- Wiping. The speed of random and LBA pattern methods accelerated by 100%
- New method of TaskForce firmware update: from USB stick
- Japanese language support
- E01 files. Partitions might not be found in other forensic tools (X-Ways, Encase)
- It was impossible to select an image file with “+” sign in its filename
- USB drives. Intermittent unsuccessful identification of certain USB drives
- INTEL SSDSC2KB240G7 solid-state drive model was not identifiable
- False Device isn't connected to TaskForce or is not responding message on certain enterprise SAS drives
- Diagnostics. Rare incorrect According to the status register, circuit board is malfunctioning message for drives on SAS ports
- Diagnostics. Estimated imaging time indication was missing for old drives with capacity below < 7 GB
- Diagnostics. Short circuit diagnosis could be missing when short circuit is detected.
2018.12
- NVMe support!
- Support of M.2, Thunderbolt, and Apple PCIe extension modules
- Imaging
- The option to image all sectors with data
Supported file systems: NTFS, APFS, ext2/3/4, HFS, HFS+, ExFAT, FAT16, FAT32
- Unclip HPA until power cycle on source drives
- Pause and Resume features support for pre-hash and post-hash calculation during imaging session
- SAS port. Performance increase by 25%
- Improved imaging of damaged drives
- New setting Save report in the target folder when imaging to a file
- E01 metadata automatically filled with case ID, investigator, description from the case management system
- User interface
- Fully revamped UI with center-aligned pages
- Better UI version for smartphones
- Short values (1K, 1M, 1G, 1T) supported in all LBA text boxes
Example: 3M will transform into 3,000,000
- 4K sector size support on SATA, SAS, USB drives
- Wiping. Added methods: NIST 800-88, DOD 5220, Random, LBA Number
- System menu. Added Release notes page and Toggle full screen feature
- USB devices. On certain devices, bad sectors were detected but not reported in the logs
- Warning when opening E01 file in Encase created by Atola TaskForce
- HPA/DCO indication missing on SATA devices plugged to SAS ports
- Issues identifying drives in PUIS mode
- Unclip HPA/DCO not working on IDE drives
- Several translation inaccuracies in the Chinese version
2018.8
- Imaging
- Overall performance increase by 25% when imaging to network shared folders
- Imaging presets with export/import features
- Export of imaged/non-imaged/error sectors into a file
- Sparse file support when writing into target images
- Improved damaged drive support for disks that freeze in the course of imaging
- Option to automatically limit target drive capacity to match that of the source via HPA
- Hashing. 100% performance increase of double-hash (MD5+SHA1) calculation reaching 650 MB/s
- Case management
- Export of one or multiple cases into a file
- Import of cases from a file
- Navigation between reports via new arrow buttons in the bottom panel
- Improvement in printing of multiple reports
- Diagnostics. Improved Media Surface check for solid-state drives
- SAS drives. SMART support
- SATA drives. Added PHY link in the bottom panel
- E01 metadata is now automatically filled from the corresponding case
- Imaging. Improved graph animation smoothness for large screen resolutions
- Imaging. After read error, error type was not showing in a corresponding log message
- Diagnostics. Removed incorrect error message for partitions larger than 8TB
- Issue when a task may not start when drive power is off
- E01 files. Invalid E01 metadata when non-Latin characters are used in Description and Investigator fields
- Issue with SATA drives in PUIS mode not getting identified in rare cases
- Multiple UI fixes
2018.1.3
- Imaging to password-protected servers and network folders
- Static IP mode for both 10Gb Ethernet ports
2018.1.2
July 1, 2018
Chinese language support
2018.1.1
June 6, 2018
- Diagnose. Error when scanning a partition of more than 2TB size
- Activation. Intermittent error during the first system activation
- Fixed other minor issues