Imaging to a compressed E01 file on a target drive

By putting a target device in Storage mode, TaskForce enables the creation of multiple image files (E01, RAW, img or dd) on the target drive.

Set a device to the Storage mode

To set a target device to the Storage mode:

Go to Image.
Select the source evidence drive.
On the Select target devices panel, switch to the Files tab and click Create file.

Selecting a target file.

In the Select image file window, click Add storage.

Adding a storage drive.

On the Select device panel, choose the drive you want to use in the Storage mode. TaskForce uses a lighter shade of blue to indicate that a storage drive is being configured.

Selecting a storage drive.

If TaskForce cannot find the appropriate exFAT partition on the selected drive, it offers you to format the device accordingly. In that case, select Format device to exFAT and click Next.

Formatting the target to exFAT.

To launch target device formatting to exFat with a large cluster size (32 MB), click Format and enter YES for confirmation. This cluster size enables faster imaging to this drive.

Formatting the target to exFAT.

Once the target device is formatted, TaskForce perceives it as a Storage target.

The drive in the Storage mode is marked with a special blue icon on the Select target devices panel.

A drive in the Storage mode.

Create a compressed E01 image file

To proceed with creating a compressed E01 image file on the storage device, do the following:

In the Select image file window, select the storage drive and then click + Create file.

Adding a new file.

In the Create image file dialog, enter the file name and select the E01 file type.

Creating an image file.

Select the Compress E01 option.
Fill out other file details, and then click Create.

Configuring the compressed E01 file.

Check your imaging settings and click Start to proceed with imaging.

When you select the Compress E01 option in the imaging settings, the multipass imaging system or reverse imaging option cannot be applied to such an imaging session. However, other fine-tuning options remain available including advanced hashing options (pre-hash, post-hash, segmented hashing, etc.) and selective imaging.

The imaging settings screen.

The Imaging completed report provides all the time stamps, hash values, and hash verification result. To look up the settings of the imaging session, you can also see the Imaging started report in the case management system.

The Imaging completed report.