Diagnosing a drive with Atola TaskForce

When an evidence drive lands on investigator’s table for the first time, there is always an uncertainty when it comes to the drive's condition. A broken head or scratched surface of the media require different imaging tactics. That’s why it is strongly suggested that before imaging, each drive should first be diagnosed.

TaskForce has Atola's unique diagnostics module which checks all systems of the drive:

• Hard drive's motor and electronics (PCB)
• Head stack
• Media surface
• All firmware/system areas
• Partitions and file systems

At the end the system produces a report which sums up all issues. The process will take only 2-5 minutes.

To start, go to Diagnose, select the drive and then click START.

Start diagnostics.

First, TaskForce checks the drive's printed circuit board. The system applies power to the device and records and analyzes spin-up current curve. This helps detect most issues with the PCB and the motor. Next, TaskForce analyzes the contents of the hard drive's ATA registers and device identification sector.

Circuit board check.

After that, the head stack is tested. Several factors are taken into consideration when diagnosing heads: media access time for each head, power consumption curves, and internal drive's error reporting systems.

If the head stack looks good, the system performs a short media scan. The purpose of this scan is to verify if there are any bad sectors in the starting, middle and ending sectors of the drive pointing to a damage to the media surface or logical errors.

Heads and media surface check.

Next, several firmware tests are performed:

Firmware check.

If TaskForce detected no issues by this point, it performs a file system checkup:

File system check.

After this final stage of diagnostics, TaskForce displays the full report. The Diagnostics result message box contains a short summary of all tests. It also provides estimated imaging time for this drive.

Diagnostics report.