Logical imaging

Preview, select, or deselect partition

The Partition section on the left lists all the partitions available on your source device.

• To preview the partition contents, click on its name.
• By default, all partitions are selected for imaging.
• To exclude a partition, clear the checkbox next to it.
• To include a partition again, select the checkbox.

Preview folder, manually include or exclude folders and files

Folders and files of the selected partition are shown in the middle section. By default, TaskForce images all files from all partitions.

• To preview a folder's contents, click on the folder name.
• To manually include a folder or file for imaging, click on its icon once. The icon turns green. The folder or file appears in the Filters section on the right as manually included.
• To manually exclude a folder or file, click on its icon twice. The icon turns orange. The folder or file appears in the Filters section on the right as manually excluded.

Apply filters

Use smart filters to automatically include or exclude specific files or folders:

1. In the Filters section, select the Custom option from the list.

2. Click the Include or Exclude button. The respective dialog appears.

3. Automatically include or exclude folders:
   1. In the respective dialog, select the Folders option from the list at the top.
   2. Click in the Folders field.
   3. Select one of the predefined options: User folders or OS folders.
   4. Or enter the folder paths, separated by commas.
   5. Click Apply.

4. Automatically include or exclude files:
   1. In the respective dialog, select the Files option from the list at the top.
   2. Specify File types by selecting predefined options from the list: archives, audio, databases, documents, emails, financial, pictures, security keys, video, and virtual machines. You can enter file extensions yourself as well.
   3. Enter file size range: from 1 byte to infinity.
   4. Narrow down time spans: when files were modified, accessed, or created.
   5. Click Apply.

All applied Include or Exclude filters appear in the Filters section.

Check filters before imaging

To test your filtering settings before imaging and get a list of files that match the selected filters, click Check at the top of the Filters section:

TaskForce scans the selected partition(s) and lists all files matching the filtering criteria. You can download this file list in CSV format by clicking the Download button at the bottom.

Downloading the list of files matching the filtering criteria.

Save filtering settings as a preset

To reuse your filtering settings later or share them with your colleague, save them as a logical imaging preset:

1. In the bottom right corner of the Logical imaging page, click the More icon with three dots.
2. Select Save to.
3. Enter the name for your preset and click Save.
   

   Saving a logical imaging preset.

From the same three-dots menu, you can also:

• Export a preset to use it on another computer.
• Import a preset created on another computer.
• Delete a preset.
  

To switch between presets, use the Current settings list on the bottom right of the logical imaging page.

Selecting a preset from the Current settings list.

How to set a drive to Storage mode

To create a target file on a drive connected directly to the TaskForce, you must first add this drive as a storage device:

1. In the Select image file window, click Add storage.
2. On the Select device panel, choose the drive you want to use in Storage mode. TaskForce uses a lighter shade of blue to indicate that a storage drive is being configured.
3. If TaskForce cannot find the appropriate exFAT partition on the selected drive, it offers you to format the device accordingly. In that case, select the Format device to exFAT option and click Next.
4. To launch target device formatting to exFat with a large cluster size (32 MB), click Format and enter YES for confirmation. This cluster size enables faster imaging to this drive.
5. Once the target device is formatted, TaskForce perceives it as a Storage target.

Pause and Resume

TaskForce lets you pause any logical imaging session and resume it later:

1. While the logical imaging process is running, click the Pause button at the bottom of the page.
2. To resume a session, click Logical on the Taskbar and then select your source device.
3. On the Recent logical imaging sessions page, click Resume next to your session.

Resuming the logical imaging session.

Use cases of Pause/Resume

When you have to temporarily power off your TaskForce:

1. Pause logical data acquisition.
2. Turn off the TaskForce.
3. Power it on later.
4. Resume the logical imaging session exactly from the very "pause" moment.

When you want your colleague to continue imaging on another TaskForce:

1. Pause logical data acquisition.
2. Export the case.
3. Transfer the source drive and the exported case to a different location that has another TaskForce.
4. Import the case.
5. Resume the logical imaging session.