1. Diagnose the drive

TaskForce is equipped with a fully-automated diagnostics module, which diagnoses all drive systems: printed circuit board (PCB), spindle motor, head stack, firmware, and file systems. Diagnostics will work properly even if the drive has burnt parts or damaged head stack – the routine makes use of the current monitor that is embedded into TaskForce unit.

After diagnostics finishes, the tool prepares a report and lets you know the exact issue with the drive; it also suggests the next step to be able to retrieve the data.

Diagnostics of damaged drive.

2. Get access to the hidden drive areas

TaskForce detects hidden areas on the drive Host Protected Area (HPA), Device Overlay Configuration (DCO), or Accessible Max Address (AMA) and can automatically recover/remove them. To avoid change the state of the drive, HPA reset until power cycle option is available.

3. Image the evidence

To ensure efficient imaging of both good and damaged drives, TaskForce is equipped with a sophisticated and powerful imaging module that creates a bit-to-bit copy of the evidence. Based on the diagnostics report, image drives with default settings or adjust them, should the media be damaged and require special treatment.

Imaging damaged drive.

Imaging good SSD. Speed: 550 MB/s.

4. Calculate hash

To ensure forensically sound evidence acquisition process, remember to calculate hash of the evidence and the image. It is essential way to prove image integrity.

With damaged devices, it is best to calculate hash during imaging (using segmented hashing). This way data on a fragile device is only read once, and less potential damage to the media is caused.

Ports, indicators & switches

Ports:

• 6 SATA
• 6 SATA/SAS
• 4 USB
• IDE
• Extension slot (for Thunderbolt, Apple PCIe SSD and M.2 SSD extension modules)

Source/target switch on each of 18 ports enabling hardware write protection in source mode:

• Source mode: helps safely connect and with the examined evidence drives to TaskForce
• Flexible port configuration: any TaskForce port can serve you as source or target depending on your needs.

LED indicators: two indicators for each of 18 ports. One indicator is located next to the port’s source/target switch and lights up when source mode is enabled.

Two 10Gb Ethernet ports

• In the lab: handles 12+ multiple imaging sessions utilizing two 10Gb network connections
• In the field: works fast with modern portable NAS solutions

Other ports: Serial RS232, IDE power, VGA, RS-232, DC IN 24V

Supported hard drive interfaces: SATA I/II/III, SAS3 (12Gb), USB 2.0/3.0, IDE

Power switch

Flash card support via card reader attached to any USB port of TaskForce.

Displays

Main display: Microsoft Surface Pro 4

• Screen: 12.3" PixelSense Display
• Resolution: 2736 x 1824 (267 PPI)
• Touch: 10 point multi-touch
• Detachable from TaskForce if necessary

IP display: OLED (20x2 characters)

Physical / Environmental

• Dimensions (including screen): 12x10x3 inches (30x25x7,5 cm)
• Weight (including screen): 4.5 lbs (3.6 kg)
• TaskForce working temperature range: 0°C – 40°C (32°F – 104°F)
• Screen working temperature range: 0° – 35°C (32° – 95°F)
• Power consumption: 60 Watt average, 280 Watt peak
• Supply Voltage: 100 - 240 VAC, 50 - 60 Hz

Other specs

• Internal OS: Linux running a custom kernel
• Control interface: web-based TaskForce application
• Removable NVMe SSD for internal case management database
• Optional WiFi 802.11n 150 Mb/s adapter in access point mode for easy connectivity (purchased separately)

View TaskForce in 3D

Inside TaskForce forensic hardware unit

TaskForce forensic hardware unit is essentially a small server-grade computer running Linux. But because neither BIOS, nor Linux kernel was designed to handle hard disk failures, Atola engineers have invested a significant amount of research and development efforts to build a highly customized and fine-tuned Linux kernel that fully overcomes these issues and handle damaged media properly. Additionally, this kernel features:

• High-speed DMA data transfers, 500+ MB/s
• Full low-level control over SATA, USB and IDE ports
• Full native SATA support
• Reset and SATA PHY control for best handling of severely damaged hard drives
• All BIOS and standard kernel functions are disabled

TaskForce hardware also features Atola's proprietary circuitry for ultimate drive's power control:

• Current sensor for in-depth hard disk diagnosis
• Automatic overcurrent and short-circuit protection
• Overvoltage protection

These features are a must for proper handling of damaged drives.

For instance, low-level control of the SATA, SAS, USB and IDE ports allows TaskForce to handle the devices that do not properly initialize, have many bad sectors, or frequently freeze due to internal (mechanical) failures. SATA PHY control allows resetting a frozen hard drive without a power cycle, thus saving time during imaging, and reducing the chances of further hard disk degradation and failure. Current sensing allows TaskForce to diagnose a failed drive even if it has electronic or mechanical damage.

Overcurrent protection detects when the drive draws abnormal current and stops it to prevent any further damage. Overvoltage protection circuit ensures that in the unlikely event of the forensic hardware malfunction, the attached drives are not damaged in any way.

TaskForce forensic hardware unit is fully controlled by the software via Chrome browser, therefore no Linux experience is required to operate it.

Magnetic screen cover

The cover protects the TaskForce screen from physical damage during transportation and allows for quick and easy packing of the unit.

Made of 2-mm thick alumium, it is sturdy to protect the screen from scratching and breaking, yet is lightweight and thin to add no additional bulk to the device.

5 magnetic screws on TaskForce's upper panel help attach the lid quickly and easily. It is as easily removed with a measured pulling motion.

The cover comes in the standard package with TaskForces assembled from September 2020 onwards. All customers with an active TaskForce subscription can receive the complimentary cover by contacting our support and providing their unit's serial number and shipping address.

TaskForce features supported for the M.2 SSD extension

All standard TaskForce operations and features are supported for the M.2 PCIe NVMe, M.2 PCIe AHCI, and M.2 SATA drives, including:

• Max read/write speed: 1300 MB/s
• Drive hotplug (excluding M.2 PCIe AHCI drives)
• Write protection with the physical source/target switch
• Diagnostics
• Physical and logical imaging
• Hash calculation
• Damaged drive support

Plug and unplug the M.2 SSD extension module

TaskForce hardware unit is equipped with the PCI Express port on its back panel, which is referred to as an Extension port. It is used to plug Atola hardware extension modules supported by Atola TaskForce software.

To connect the M.2 SSD extension module to TaskForce, do the following:

1. Power off TaskForce.
2. Align 3 holes on the extension module and 3 screw holes on the Taskforce back panel. Firmly plug the M.2 SSD extension module into the Extension port and fasten the module with 3 screws.
3. Plug an M.2 PCIe NVMe, M.2 PCIe AHCI, or M.2 SATA drive into the extension and fasten the drive in place with the black plastic slider.
4. Optional: If you plan to work with M.2 SATA drives, connect the extension to one of the SATA ports on TaskForce using a SATA cable. For details, see Connect and identify an M.2 SATA drive section on this page.
5. Power on TaskForce.

To disconnect the M.2 SSD extension module or replace it with another extension module, do the following steps:

1. Power off TaskForce.
2. Disconnect the SATA cable from the extension module.
3. Release the screws, which hold the module, and unplug it from the Extension port.
4. Optional: Plug another extension module into the Extension port and fasten the module with a screw.
5. Power on TaskForce.

Distinguish between M.2 NVMe/M.2 AHCI, and M.2 SATA drives

All solid state drives with M.2 form factor look pretty much the same.

But there are different ways to connect M.2 PCIe NVMe and M.2 PCIe AHCI drives on one hand, and M.2 SATA drives on the other hand to TaskForce using the M.2 SSD extension module.

The easiest way to tell apart M.2 NVMe and M.2 PCIe AHCI drives from M.2 SATA drives – when the extension is connected and TaskForce is powered on – is to look at the LED indicator on the extension module, next to the words "When LED is on, plug SATA source port cable here":

• If the LED is off, the drive connected to the M.2 SSD extension module is either M.2 NVMe or M.2 PCIe AHCI. See Connect and identify an M.2 NVMe or M.2 AHCI drive.
• If the LED is on, the drive is M.2 SATA. See Connect and identify an M.2 SATA drive.

To define the type of the particular M.2 drive before connecting it to TaskForce, check the markings on the drive or refer to the manufacturer’s specifications.

Connect and identify an M.2 NVMe or M.2 AHCI drive

To identify the M.2 PCIe NVMe or M.2 PCIe AHCI drive, TaskForce must be first booted with that particular type of drive connected to the M.2 SSD extension module:

1. Power off TaskForce.
2. Plug an M.2 PCIe NVMe or M.2 PCIe AHCI drive into the extension and fasten the drive with the black plastic slider.
3. Power on TaskForce and wait for the booting to be completed.
4. In the TaskForce main window, click Devices.
5. Click the port in the EXT section of the Select device panel.

NVMe M.2 drive in the EXT section of the Select device panel.

Work consecutively with several M.2 NVMe drives

Drive hotplug is supported for M.2 PCIe NVMe drives, but not for M.2 PCIe AHCI drives. You can plug several M.2 NVMe drives one after another, without turning TaskForce off and on.

To identify the M.2 PCIe NVMe drive, TaskForce must be first booted with that particular type of drive connected to the M.2 SSD extension module. After you boot TaskForce with an M.2 NVMe drive connected to the extension module, the system identifies all other M.2 NVMe drives without rebooting the hardware unit.

To define the type of the particular drive, check the markings on it or refer to the manufacturer’s specifications.

The hotplug for M.2 PCIe NVMe drives was added in TaskForce firmware update 2021.4.

Connect and identify an M.2 SATA drive

When you plug an M.2 SATA drive into the M.2 SSD extension module, TaskForce lights up the LED indicator on the module, next to the words "When LED is on, plug SATA source port cable here".

M.2 SATA drives appear in the SATA section in the Select device panel, not in the EXT section, as M.2 NVMe or M.2 AHCI drives do. For example, if you connect M.2 SSD extension with the SATA cable to SATA 1 port on the TaskForce hardware unit, the drive will appear in the corresponding SATA 1 port in the TaskForce software.

To connect an M.2 SATA drive to TaskForce, do the following steps:

1. Using the SATA cable, connect the M.2 SSD extension module to one of the SATA ports on TaskForce.
2. In Atola TaskForce software, power off the SATA port.
3. Plug an M.2 SATA drive into the extension and fasten it in place with the black plastic slider.
4. In Atola TaskForce software, power on the SATA port.

Work consecutively with several M.2 SATA drives

For M.2 SATA, drive hotplug is supported. It allows connecting and replacing M.2 SATA drives without turning TaskForce off and on again.

To determine if a particular M.2 drive is SATA type or not, check the markings on it or refer to the manufacturer’s specifications.

Also, if your drive belongs to the SATA type, TaskForce will light up the LED indicator on the extension module, next to the words "When LED is on, plug SATA source port cable here".

Connect a U.2 NVMe drive using adapter

To use a drive with U.2 interface, attach the drive to TaskForce with the help of a U.2-to-M.2 adapter and a cable (not included in the package).

To connect a U.2 drive to TaskForce, do the following:

1. Plug the U.2 drive into the U.2-to-M.2 adapter using the cable.
2. Plug the U.2-to-M.2 adapter into the Atola M.2 SSD extension.
3. Plug the extension into TaskForce while the unit is powered off.

TaskForce features supported for Apple PCIe SSD extension

The following TaskForce operations and features are supported for the Apple drives:

• Write protection with the physical source/target switch
• Diagnostics
• Physical and logical imaging
• Hash calculation
• Damaged drive support

Plug and unplug the Apple PCIe SSD extension module

TaskForce hardware unit is equipped with the PCI Express port on its back panel, which is referred to as Extension port. It is used to plug Atola hardware extension modules supported by Atola TaskForce software.

To connect the Apple PCIe SSD extension module to TaskForce, do the following:

1. Power off TaskForce.
2. Align the screw on the extension module and the top screw hole on the Taskforce back panel. Plug the Apple PCIe SSD extension module into the Extension port and fix the module with a screw.
3. Plug an Apple PCIe SSD drive into the extension and fasten the drive with the black plastic latch.
4. Power on TaskForce.

To disconnect the Apple PCIe SSD extension module or replace it with another extension module, do the following steps:

1. Power off TaskForce.
2. Release the screw, which holds the module, and unplug it from the Extension port.
3. Optional: Plug another extension module into the Extension port and fix the module with a screw.
4. Power on TaskForce.

TaskForce features supported for Thunderbolt extension

TaskForce supports the following operations and features on MacBooks when connected through Thunderbolt extension:

• Write protection with the physical source/target switch
• Physical and logical imaging
• Hash calculation
• Damaged drive support

Plug and unplug the Thunderbolt extension module

TaskForce hardware unit is equipped with the PCI Express port on its back panel, which is referred to as an Extension port. It is used to plug Atola hardware extension modules supported by Atola TaskForce software.

To connect the Thunderbolt extension module to TaskForce, do the following:

1. Power off TaskForce.
2. Align the screw on the extension module and the top screw hole on the Taskforce back panel. Plug the Thunderbolt extension module into the Extension port and fasten the module with a screw.
3. Power on TaskForce.

To disconnect the Thunderbolt extension module or replace it with another extension module, do the following steps:

1. Power off TaskForce.
2. Release the screw, which holds the module, and unplug it from the Extension port.
3. Optional: Plug another extension module into the Extension port and fix the module with a screw.
4. Power on TaskForce.

Connect MacBook using Thunderbolt extension module

First, write down or take a photo of the serial number located on the bottom side of the MacBook. It will be needed later.

Then do the following steps:

1. Turn off both the MacBook and TaskForce.
2. Plug the Thunderbolt extension module into the Extension port and fasten the module with a screw.
3. Connect the MacBook to TaskForce unit with the help of the Thunderbolt extension and the FireWire cable. Use adapters to connect to the MacBooks with Thunderbolt 2 or Thunderbolt 3 interface.
4. Boot the MacBook in the Target Disk Mode. To do that, start it up while holding down the T key. You should see a Firewire or Thunderbolt icon displayed on screen, signifying that Target Disk Mode is detected and working.

5. Power on TaskForce and wait for the booting to be completed.
6. In the TaskForce main window, open the Device panel.
7. Click the port in the EXT section of the Device panel.

MacBook device in the EXT section of the Device panel.

8. If it is the first time this MacBook is identified by TaskForce, in the Enter MacBook serial window, enter the serial number located on the bottom side of the MacBook, and then click OK.

Enter MacBook's serial number.

During the subsequent identifications of the MacBook connected to TaskForce, its serial number can be selected from the drop-down menu in the Enter MacBook serial window. TaskForce will look up its case management system and offer the choice of MacBooks with the same drive size.

Select the MacBook with the serial number you have connected to TaskForce.

Buy subscription

To extend your subscription for another period, you need to buy it first either from the reseller that sold you the unit or on the Atola website.

If your subscription has not yet expired, you can still purchase and activate a new one. The new subscription period will commence the day following the current subscription’s expiration date.

Depending on where you bought the subscription, there are two ways to activate and extend it:

• Extend subscription you bought from the reseller
• Extend subscription you bought on the Atola website

Extend subscription you bought from the reseller

Choose this option if you have purchased a subscription from the reseller that sold you the TaskForce hardware unit or from the Atola sales department.

You will need:

• A device with an internet connection (PC or mobile).
• The serial number located on the bottom side of the TaskForce unit.

After you have purchased a subscription, do the following:

1. On a device with an internet connection, open the TaskForce user interface in your web browser.
2. At the top right, click Menu > Activation status.

The Activation status option in the TaskForce Menu.

3. Click Extend subscription.

The Extend subscription button on the Activation status page.

4. Enter the serial number of the TaskForce unit.
5. Select I already extended my subscription through a distributor, and then click Next.

The Extend subscription page.

6. Visit the Atola licensing page: a.atola.com or scan QR code on the screen.
7. On the Atola licensing page, enter the license key shown in TaskForce web interface.
8. Fill out all other fields on the Atola licensing webpage, including:
   • Customer name
   • E-mail address for activation code
   • Telephone
   • Organization, country and city

9. Click Submit. The Atola licensing webpage generates an activation code.
10. Go back to TaskForce user interface and enter the activation code in the respective field.

Entering the activation code on the Extend subscription page.

11. Click Activate. TaskForce confirms that reactivation has been successfully completed.

Extend subscription you bought on the Atola website

Choose this option if you have purchased a subscription key on the Atola website: tf.atola.com.

You will need:

• A device with an internet connection (PC or mobile).
• A subscription key.
• The serial number located on the bottom side of the TaskForce  unit.

After you have purchased a subscription key, do the following:

1. On a device with an internet connection, open the TaskForce user interface in your web browser.
2. At the top right, click Menu > Activation status.

The Activation status option in the TaskForce Menu.

3. Click Extend subscription.

The Extend subscription button on the Activation status page.

4. Enter the serial number of the TaskForce unit.
5. Select I want to extend subscription by key, and then click Next.

The Extend subscription page.

6. Visit Atola licensing page: s.atola.com or scan the QR code on the screen.
7. On the Atola licensing page, enter the subscription key you bought on the Atola website.
8. On the Atola licensing page, enter the license key shown in the TaskForce web interface.

The license key shown in the TaskForce web interface.

9. Fill out all other fields on the Atola licensing webpage, including:
   • Customer name
   • E-mail address for activation code
   • Telephone
   • Organization, country and city

10. Click Submit. The Atola licensing webpage generates an activation code.
11. Go back to TaskForce user interface and enter the activation code in the respective field.

Entering the activation code on the Extend subscription page.

12. Click Activate. TaskForce confirms that reactivation has been successfully completed.

10Gb Ethernet network

TaskForce is equipped with two 10Gb Ethernet ports. Whenever the system is connected to a local network via one of its Ethernet ports, an IP address will be displayed on the IP screen on the front panel of the system.

Supported network features:

• Two 10Gb Ethernet ports
• Dynamic (DHCP) IP / Static IP address
• Settings: DNS nameserver, Default gateway, Jumbo frames
• Secure connection with password-protected network folders
• Support of HTTPS with external organizational and self-signed certificates

IP address of Atola TaskForce

If the system is connected via both Ethernet ports, two IP addresses will be displayed on the screen. These IP addresses are assigned to TaskForce by your DHCP server.

Multi-user access

With the help of these IP addresses, TaskForce can be operated by multiple users simultaneously from their workstations or mobile devices:

• enter either of the IP addresses as shown on the IP screen in Chrome browser on another device within the same local network.

Enter IP address in Chrome browser

Through Chrome browser one can remotely track and manage tasks, power devices on and off, open, edit and print cases etc.

Types of devices that can be used to access TaskForce simultaneously include:

• Desktop PC
• Laptop
• Tablet
• Smartphone
• Built-in TaskForce touch screen

TaskForce software can be open in Chrome browser within any OS.

This functionality enables a group of users to work on different assignments using the same tool. This helps utilize TaskForce’s multitasking capabilities to the maximum and track operation progress remotely. The number of users accessing TaskForce simultaneously is unlimited.

Standalone mode

TaskForce is equipped with highly responsive HD screen (see Hardware specs), which allows the system’s use in standalone mode.

Whenever the system is not connected to a network via its 10Gb Ethernet ports, Standalone mode status will be displayed on the IP screen.

In this mode, you can image data from multiple source drives to target drives in parallel. Thanks to its compact size TaskForce can be easily used in the field.

Wi-Fi access point

The third way to access TaskForce's user interface is via Wi-Fi 802.11n 150 Mb/s adapter. The adapter is optional and can be purchased from your preferred retailer. Here is a link to the supported adapter sold on Amazon. To enable the adapter, follow these steps:

1. Connect the adapter to one of your TaskForce's USB ports.
2. Go to Menu in the top right corner of the TaskForce web page.
3. Click Settings.
4. Enable Wi-Fi Hotspot. An IP address will appear underneath the Wi-Fi Hotspot category.
5. Click Settings.

Enable Wi-Fi Hotspot

5. Enable Wi-Fi Hotspot.
6. Set SSID and Password. To make the network invisible to other devices, select Hidden mode. Click Save.
7. Use these details to connect to the Hotspot from another device.

Adjust Wi-Fi settings

8. To open the TaskForce interface, enter the IP address (indicated under Wi-Fi Hotspot category in the Settings window, see Step 3) in the Chrome browser of the device you have connected to the Hotspot.

The vast connectivity options make TaskForce a great tool for using both in the lab and in the field.

What others can see and do when you share one TaskForce

After you enable User management, you become an administrator and can create up to 20 profiles with either Admin or User roles. These roles have different permissions.

What an Admin can see and do

The first profile that you create after enabling User management has an Admin role. You can have more than one profile with the Admin role on your TaskForce.

As an Admin, you can:

• See and edit all cases of other users.
• See and stop all processes run by other users.
• See and print all reports created by other users.
• Access and change all TaskForce settings.
• Enable or disable User management.
• Add, edit, or delete other user profiles with either Admin or User role.
• Change other user’s password.
• Set TaskForce to automatically lock the screen after a certain time of inactivity.

Admin sees all processes and cases of other users.

What a User can see and do

A profile with a User role is created by Admin and has limited access to TaskForce.

As a User, you can:

• Log in only to your user profile.
• See and edit only your cases.
• See and print only your reports.
• See, run, and stop only your processes.
• Change only your password.

As a User, you can’t:

• Access somebody else’s user profile.
• See and edit other users’ cases.
• See and print other users’ reports.
• See or interrupt other users’ processes.
• Access a device that is being used by another user
• Access and change TaskForce settings.
• Enable or disable User management.
• Add, edit, or delete other user profiles.
• Change other user’s password.
• Disable or configure Automatically lock screen feature set by Admin.

Profiles with a User role see only their cases and processes.

Profiles with a User role don’t see each other’s cases and processes.

Enable User management

The first profile, what you create after enabling User management, has an Admin role.

To enable the multi-user mode in Atola TaskForce, do the following steps:

1. In the Atola TaskForce window, go to Menu > Settings.
2. In the Users section, toggle User management.
3. Enter the username and password for the administrator’s profile, and then click Create.

Now you can add, edit, or delete other user profiles.

User management toggle in the Users section of the Settings menu.

Add, edit, or delete users

Only Admin can add, edit, or delete other user profiles with either Admin or User role.

Add a user

To add a user, do the next steps:

1. Log in to a profile that has the Admin role.
2. In the Atola TaskForce window, go to Menu > Settings.
3. In the Users section, click Manage.
4. On the Users page, click Create user.
5. Enter the username and password for a user.
   Optional: To grant this user an Admin role, select Admin checkbox.
6. Click Create.

The Create user button and dialog.

Edit a user

To edit a user, do the following:

1. Log in to a profile that has the Admin role.
2. In the Atola TaskForce window, go to Menu > Settings.
3. In the Users section, click Manage.
4. On the Users page, select a user you want to edit.
5. In the Edit user dialog, edit the username.
   Optional: To grant this user an Admin role, select Admin checkbox.
6. Click Save.

The Edit user dialog.

Delete a user

After deleting a user, you can still access their cases and reports under a profile with the Admin role.

To delete a user, do the following steps:

1. Log in to a profile that has the Admin role.
2. In the Atola TaskForce window, go to Menu > Settings.
3. In the Users section, click Manage.
4. On the Users page, select a user you want to delete.
5. In the Edit user dialog, click the Delete icon.
6. In the confirmation dialog, enter YES, and then click Delete.

The Delete icon in the Edit user dialog.

Log in and log out

To log out, click Menu > Log out. Atola TaskForce locks itself and prompts you to enter a username and password. All the processes you started before logging out are still running in the background.

To log in, enter your username and password, and then click Log in. Atola TaskForce unlocks itself and shows its Home screen.

Atola TaskForce is locked and prompts you to enter a username and password.

Change the password

As a User, you can change only your password. As an Admin, you can change other users' passwords as well.

Change the password for your profile

To change the password for your profile, go to Menu > Change your password, enter your current and new passwords and click Save.

Change your password command in the Menu.

Change the password for another user as an administrator

To change the password for another user, do the following:

1. Log in to a profile that has the Admin role.
2. In the Atola TaskForce window, go to Menu > Settings.
3. In the Users section, click Manage.
4. On the Users page, select a user you want to change the password for.
5. In the Edit user dialog, enter a new password, confirm the password, and then click Save.

If you forgot or don’t know the password for an administrator profile on your TaskForce, contact Atola Support.

Changing a user password in the Edit user dialog on the Users page.

Automatically lock screen

As an Admin, you can set up Atola TaskForce to automatically lock its screen after a certain time of inactivity. To enable this feature, log in to a profile with the Admin role and do the next steps:

1. Go to Menu > Settings.
2. In the Users section, toggle Automatically lock screen.
3. Enter a time interval in minutes you want TaskForce to wait before automatically locking in.

The Automatically lock screen toggle in the Users section of the Settings menu.

Disable User management and password protection

As an Admin, you can disable user management and password protection for your Atola TaskForce.

To disable user management and password protection, do the following steps:

1. Log in to a profile that has the Admin role.
2. Go to Menu > Settings.
3. In the Users section, toggle off User management.

Toggling off User management.

Set up 10Gb Ethernet network

Atola TaskForce is equipped with two 10Gb Ethernet ports. To fully use this potential and achieve the best imaging speeds, every node in your local network between the TaskForce unit and your computer or server need to support 10Gb connection as well.

Use 10Gb network adapter

Make sure that a network adapter on your server or your computer supports a 10Gb connection:

• Check vendor specifications for your network adapter.
• Check the network adapter speed in your OS settings.

How to check Ethernet connection speed on Windows 10 and Windows 11

1. Go to Control panel > Network & Internet > Network and Sharing Center.
2. In the View your active networks section, click your Ethernet connection.
3. In the Status window, check the connection speed. It must be equal to 10 Gbps.

Use 10Gb network cable

Make sure that the network cable you use to connect your TaskForce unit and your local network nodes supports 10Gb connection. It must have Cat6 (with the length of less than 55 meters), Cat6a, Cat7, Cat7a, or Cat8 marking on it.

Use 10Gb router or switch

If your TaskForce unit is connected through a network router or switch, make sure that every such device in your local network in between TaskForce and the target computer or server supports a 10Gb connection:

• Check vendor specifications for your network router or switch.
• Check that the 10Gb network cable is connected to a 10Gb port on your router or switch.

Enable jumbo frames

To speed up your 10Gb network, enable jumbo frames on your TaskForce, your target device, and every network switch or router in between them.

Jumbo frames increase the efficiency of broadband Ethernet processing because they carry 9000 bytes of payload, which is more than the standard limit of payload.

Enable jumbo frames on TaskForce

To enable jumbo frames on your TaskForce unit, do the following:

1. In the Atola TaskForce interface, go to Menu > Settings.
2. In the Network section, toggle Jumbo frames for respective Ethernet port (ETH1 or ETH2). Default MTU (maximum transmission unit) value is set to 9000 bytes, don’t change it.

Jumbo frames toggle on the Settings page in Atola TaskForce.

Enable jumbo frames on a target computer

To enable jumbo frames for 10Gb network adapter on a target computer running Windows 10 or Windows 11, do the next steps:

1. Go to Control panel > Network & Internet > Network and Sharing Center.
2. In the View your active networks section, click on your Ethernet connection.
3. In the Status window, click Properties.
4. In the Properties window, click Configure and go to the Advanced tab.
5. On the Advanced tab, select Jumbo Packet and change its Value to 9014 Bytes.
6. Click OK.

Enable jumbo frames on a network router or switch

Jumbo frames need to be enabled on network routers or switches, which connect your TaskForce unit with your target computer or server.

Many 10Gb routers and switches support jumbo frames by default.

For specifications and instructions, refer to a router or switch user guide provided by its manufacturer.

Use Samba version 3.0 or later

Samba is a free software that provides fast shared access to files and printers for all network clients using the SMB/CIFS protocol.

We recommend using Samba version 3.0 or later to speed up the imaging to the files on network-connected drives.

For guidance, refer to the Samba installation guide.

Update OS and drivers

Install the latest OS and driver updates.

Due to various software issues, the local network speed can be lower than expected if the operating system and network drivers are outdated.

Check server use quota

Sometimes, a network administrator can create quotas, which limit server space or throughput for end users.

Check if there is an opportunity to change or lift these quotas to achieve maximum data throughput during imaging.

Use faster target drives

To achieve higher imaging speeds, we recommend using faster destination drives with reading and writing speeds of no less than 600 MB per second.

If you’re using a RAID array as a storage, consider choosing RAID types with faster reading and writing speed, such as RAID 0 and RAID 5.

When storing very big files, opt for a large cluster size on your server. The bigger files you want to store, the larger cluster size should be.

Configure TaskForce for using a static IP address

1. On your computer, open a Chrome browser and in its address bar enter the IP address, displayed on the TaskForce front panel. You can use TaskForce touchscreen as well.
2. In the TaskForce interface, go to Menu > Settings.

TaskForce system menu.

3. In the Network section, find the IP settings for the ETH1 or ETH2 port and click the Edit icon next to it.

The Edit icon next to IP settings for the ETH 1 port.

4. Enter the following network settings:
• IP address: 10.0.0.XXX, where XXX can be any number from 1 to 254.
  Default static IP addresses of the TaskForce unit are 10.0.0.215 and 192.168.0.215.
  The IP address of your PC's Ethernet card must be different from that of the TaskForce unit.
• Network mask: 255.0.0.0.
  If your PC and the TaskForce unit belong to different subnets, the connection can’t be established.
• Default gateway and DNS can be left empty or set to any value.
5. Click Save. The new IP address appears on the TaskForce front panel.

Network settings for the ETH1 port.

Connect TaskForce directly to your computer

To use a static IP address, connect your computer to the ETH1 or ETH2 port of TaskForce with an Ethernet network cable.

If your computer has no Ethernet port, you can use the USB-to-Ethernet adapter (not included in the package). Connect it to your computer before configuring a network.

Configure your computer for using a static IP address

1. In Windows, open Network Connections: press Win+R, enter ncpa.cpl and click OK.
2. Right-click your Ethernet adapter, and then select Properties.
3. Select Internet Protocol Version 4, and then click Properties.
4. Enter the following network settings:
• IP address: 10.0.0.XXX, where XXX can be any number from 1 to 254 except for 215.
  Default static IP addresses of the TaskForce unit are 10.0.0.215 and 192.168.0.215.
  The IP address of your PC's Ethernet card must be different from that of the TaskForce unit.
• Network mask: 255.0.0.0.
  If your PC and the TaskForce unit belong to different subnets, the connection can’t be established.
• Gateway and DNS server can be left empty or set to any value.
5. Click OK.

Configuring 10Gb network with DHCP-enabled switch

You need to create or extend network with DHCP-enabled switch with 10Gb connection.

Example. Ubiquiti EdgeSwitch 16 XG: four 10Gb Ethernet ports, twelve 10Gb SFP ports. Approximate price: $600.

This kind of switch supports static IP setup via simple web admin. So you could set the IP addresses you need for each current network device.

How to configure Ubiquiti DHCP server:

1. Connect PC and TaskForce to Ubiquiti switch.
2. Set static IP address of PC to 192.168.1.4.
3. Open a browser and enter 192.168.1.2 (default Ubiquiti switch IP).
4. Log in with default credentials: ubnt (both in name and password fields).
5. Go to System > Advanced Configuration > DHCP server > Global.
6. Activate Admin mode by checking a necessary checkbox and pressing Submit button.
7. Go to Pool Summary and press Add to make a new address pool.
8. Enter your:
• pool name
• network base address (for example, 192.168.1.0)
• network mask (in most cases, it should be 255.255.255.0)
• put Default Router Address and DNS
After creating your pool, you can change it via Pool configuration tab.
9. Click Save configuration button in the upper right corner of the window and click Save.

You can check this Youtube guide for alternative instructions on network setup using Ubiquiti switch.

Getting maximum performance of Ubiquiti EdgeSwitch 16 XG network

To optimize performance using Ubiquiiti EdgeSwitch 16 XG, you need to enable 10Gb with jumbo frames:

1. Go to Basic > Port summary.
2. Select ports 0/13, 0/14, 0/15, 0/16 and click Edit.
3. Change Maximum Frame Size to 9014 in Edit Port configuration window.

Configuring a dynamic IP for TaskForce in a network without router or DHCP-enabled switch

If there is no hardware in the network that assigns IP address, or if you want to keep a small network with TaskForce and your server/PC connected directly, it is possible to install and setup software DHCP server. The good news is, it does not require any investment. All you need is some time to set it up on any computer in the server network. Follow the instructions from these guides:

• Windows: Free DHCP server.
• Linux: Included DHCP service.

Accessing Windows Server 2012 shared folder

If you want to store a target image file in a Window Server 2012 network folder but it appears missing, please follow these steps:

1. Go to Control panel.
2. Enable Guest account (Administrative tools > AD users and computers > Users).
3. Network and sharing center > Change advanced sharing settings > Turn On network discovery + Turn on sharing (file and printers + public folders).
4. In the shared folder access options, add Guest or Everyone.

If the shared folder demands restricted access, please follow this guide.

Setting up Synology DS218 as storage server

To set up Synology DS218:

1. Go to Control panel > File services > SMB > Advanced settings.
2. Set Maximum protocol to SMB3.
3. Go to Control panel > Shared folder.
4. Click Create button and specify network folder details.

If you need to get a guest account working, run the following actions:

1. Go to Control panel > User.
2. Edit for Guest user.
3. Clear the Disable this account checkbox.

Table of contents

Setting up Synology
Setting up QNAP
Direct connection with a Static IP:

1. Configuring TaskForce
2. Configuring Static IP in Synology
3. Configuring Static IP in QNAP

Setting up LAN using a router with DHCP (Dynamic IP):

1. Configuring the router
2. Configuring DHCP in TaskForce
3. Configuring DHCP in Synology
4. Configuring DHCP in QNAP

Setting up a Synology NAS

1. Install drives in the Synology NAS.
2. Use a LAN cable to connect the DiskStation to your switch, router, or hub.
3. Press the power button to turn on your Synology NAS.
4. Install DiskStation Manager (DSM) – Synology’s browser-based operating system – on your DiskStation.
5. Follow the instructions to create a RAID volume and a partition with a file system on it.

Enabling SMB3 is highly recommended for the best performance:

1. Go to Control panel > File services > SMB > Advanced settings.
2. Set Maximum protocol to SMB3.
3. Go to Control panel > Shared folder.
4. Click Create and specify network folder details.

6. Create a Shared folder in the new volume:
   Control panel > File sharing > Shared folder > Create > Create Shared Folder

7. In the folder creation menu, set the folder name, e.g. Image Files and set access options.

Setting up a QNAP NAS

1. Install drives in the QNAP NAS.
2. Use a LAN cable to connect the QNAP to your switch, router, or hub.
3. Press the power button to turn on your QNAP.
4. Install Qfinder Pro for quick find and easy access to QNAP NAS on the same LAN.
5. Find your QNAP using Qfinder Pro and go to its page in the browser.
6. Follow instructions to complete Smart Installation.

7. Create Storage Pool (RAID):
   1. Storage & Snapshots.
   2. Storage (left menu).
   3. Storage/Snapshots.
   4. New Storage Pool (in the the top right corner).
   5. Follow the instructions to set up the Storage Pool.

8. In the final stages of setting up the Storage Pool, create a New Volume.

9. In the File Station utility, you can find the new volume: QNAP. In it, there is a Shared Folder created by default called Public.

10. For a Shared Folder with specific access or encoding settings, create a new one by clicking the icon showing a folder with a + and adjust the configuration.

Direct connection with a Static IP:

Since we are not connecting TaskForce and Synology/QNAP NAS to a wider network, it is enough to set up the same Subnet Mask for the NAS and the TaskForce, and configure Static IP addresses that will indicate the same network.

TaskForce configuration

1. Go to Menu > Settings > Network section.
2. Select the Ethernet port through which Synology is connected (e.g. ETH1).
3. Click IP settings’s Edit icon.

4. In the ETH settings dialog, enter the address (e.g. 255.255.0.0) in the Subnet Mask field that is identical to that of Synology.
   
5. Assign an IP address using the Subnet Mask: the first two bytes of TaskForce’s IP must be identical to those of IP Synology (e.g. 10.0.0.15). This will ensure that both TaskForce and Synology belong to the same network. (e.g. 10.0.0.8).

6. Click Save.

Setting up a Static IP in Synology

1. Go to the Control panel.
2. Open Network interface.
3. Select the current connection to Synology.
4. Click Edit.

5. On IPv4 tab, select Use manual configuration.
6. Assign Subnet Mask (e.g. 255.255.0.0), which is identical to that of TaskForce.
7. Assign IP address (e.g.: 10.0.0.15).
8. Click ОК.

9. After Synology has changed the settings, it can be disconnected from the current network.

Setting up Static IP in QNAP

1. In the Control panel, go to Network & Virtual Switch.
2. Select the current connection to QNAP.
3. Open the Menu.
4. Click Configure.

5. On the IPv4 tab, select Use static IP address.
6. Assign a Subnet Mask (e.g. 255.255.0.0), which is identical to that of TaskForce.
7. Assign an IP address (e.g.: 10.0.0.16).
8. Gateway field should be left blank because you are configuring a LAN and connecting to other networks is unnecessary.
9. Jumbo Frame and Network speed should be left with the default values.
10. Click Apply.

11. After the QNAP has changed the settings you can disconnect it from the current network.

Connecting to the Shared Folder in TaskForce

1. Connect the Synology/QNAP NAS to TaskForce’s ETH1 port.
2. Click the Devices icon in the upper right corner. Go to the File section and click Select File.
3. Click Connect.
4. Enter the Server name, Username, Password.
   If you do not remember the server name, look it up:
   Synology > Control Panel > Info Center > Server name
   QNAP > Control Panel > General Setting > Server name
5. Click Connect.

6. TaskForce has connected to Synology and you can open the previously created Shared Folder.

Setting up a LAN using router with DHCP (Dynamic IP)

Setting up router

1. Connect the router directly to your PC or laptop via the Ethernet port.
2. Log in to the web configurator.
3. Turn on the DHCP server in the local network settings.
4. Apply changes.

Setting up DHCP in TaskForce

1. Open Menu > Settings, go to the Network section.
2. Select the Ethernet port to which Synology will be connected. (e.g. ETH1).
3. Click the Edit icon to adjust the IP settings.
4. Clear the Use static IP address checkbox.
5. Click Save.

Setting up DHCP in Synology

1. Go to Control panel > Network > Network interface.
2. Select the current connection to Synology and click Edit.
3. On the IPv4 tab, select the Get network configuration automatically (DHCP) option.

Setting up DHCP in QNAP

1. In the Control panel, go to the Network & Virtual Switch.
2. Select the current connection to QNAP, open the Menu and select Configure.

3. On the IPv4 tab, select Obtain IP address settings automatically via DHCP.

Connecting the LAN devices

After all the reconfigurations, connect TaskForce, NAS and your PC or laptop to the router using Ethernet ports and connect to the Shared Folder as described above.

Powering on TaskForce

The power switch is located on the back panel of the unit. To start TaskForce, turn the power switch on.

Booting

The booting process takes up to 3 minutes.

Once booting is completed, the IP screen on the front panel will display either "Standalone mode" message or the IP address if the unit be connected to the Ethernet. At this point, the unit is ready for operation.

TaskForce screen

The Microsoft Surface Pro tablet that serves as TaskForce's screen is switched on and off independently from the unit, by pressing the button in the tablet's top panel.

Connecting drives

TaskForce supports SAS, SATA, USB, and IDE drives via its 17 ports, as well as other storage devices via Thunderbolt, Apple PCIe, and M.2 SSD extension modules.

To ensure both TaskForce and the devices connected to it are used properly and safely, read the instructions below.

Connecting USB devices

TaskForce system must be powered on before a USB device is plugged in. As soon as booting is finished and the IP address is displayed you can plug the USB device into any of 4 USB ports available.

Connecting Extensions

Before connecting an extension module, make sure TaskForce is powered off. Plug the extension module into the extension slot located on the back panel of TaskForce and power the unit on.

Connecting evidence drives

Each port is equipped with an individual Source switch enabling hard write protection on the port. To make sure data on the drive is not overwritten, make sure the port is in the source before you connect the evidence drive.

Connecting SATA & SAS drives

TaskForce has 6 SATA and 6 SATA/SAS ports. Before connecting evidence and target devices to the imager, make sure the ports are switched to the right mode.

When a drive is connected to a running TaskForce imager, the port is by default powered off. To identify the device plugged into the port, click the Devices button in the top panel of the TaskForce interface, and TaskForce will start to identify all connected drives. The system ensures sustainable overall power consumption in the situations when many drives are plugged in.

Powering off TaskForce

If TaskForce is not running any processes, it is safe to power off the unit by turning off the power switch. Any sessions that were active at the moment the unit was powered off (whether it is due to an outage or the power switch being turned off) will not be stopped correctly and cannot be resumed later.

1. Home icon

The Home button brings you back to the Home screen. This is where you can check the active and recently completed tasks in the respective sections of the screen.

The number of current active processes is indicated next to the Home icon in a small orange circle.

2. Taskbar

The Taskbar on the left shows main TaskForce operations:

1. Diagnose
2. Image
3. Logical
4. RAID
5. Wipe

Click the Other button in the Taskbar to access 4 more important TaskForce operations:

1. Hash: Calculates hash of a device: MD5, SHA-1, SHA-256, SHA-512.
2. View SMART: Shows all SMART attributes as a table.
3. Browse files: Shows the content of partitions on a device.
4. Hidden drive areas: Lets you to unclip or change HPA, DCO, AMA limitations.

Section with other tasks: Hash, View SMART, Browse files, Hidden drive areas.

3. Cases

By clicking the Cases button in the top panel you get to the Cases page with a list of the latest cases. With the help of the Search bar you can find a specific case. The cases are available for import and export between different TaskForce units.

An overall view of the Cases page with a list of the latest cases.

4. Reports

By clicking the Reports button in the top panel you get to the Reports page that is equipped with a similar search bar. The reports can be selected and printed directly from this page.

The Reports page with a list of the latest reports.

5. Current overall performance

To check the Current overall performance, click Atola logo in the top panel. This lets you to keep track of the unit’s capacity usage. TaskForce allows running processes at 15 TB/hour and more.

Current overall performance shows after you click Atola logo.

6. Devices

Click Devices button in the top panel to see all the drives connected to TaskForce to obtain maximum information about each by simply clicking it.

The Devices panel provides additional options for working with the drives: add a case for a device, re-identify or power off any device.

The Devices panel is expanded and shows all the drives connected to TaskForce.

7. Menu

The Menu contains device settings and features that regulate your use of the TaskForce unit.

The Menu gives access to Atola TaskForce settings, express mode, full screen mode, realease notes, and manual.

In Settings you can adjust the general, database, network, print, and other settings.

Express mode enables automatic launch of multiple imaging sessions on all ports that are set to source. For more details, see Express mode: self-launching imaging.

Toggle fullscreen option is handy when working with other programs or files.

In Update firmware you can check the current TaskForce firmware, choose update method and perform the firmware update by selecting and downloading the firmware file.

Activation status lets you to look up, reactivate the status, or extend the subscription.

In Release notes you can read the information about the most recent Atola TaskForce firmware release and track all updates and enhancements by clicking corresponding links.

View SMART table

SMART table is included in the Diagnostics report. If you want to have a look at the current indices:

1. Go to Other > View SMART.
2. Select the drive.
3. Click Start.

SMART table report.

SMART table attributes may differ depending on the drive manufacturer. The most critical attributes are:

• Reallocated sectors count.
• Current pending sector count.
• Uncorrectable sector count.

When RAW value of any of these attributes is greater than zero, TaskForce highlights it in yellow.

The worse the values, especially in these critical attributes, the more carefully the drive needs to be treated.

Track changes of the SMART table attributes

To keep track of the changes occurring to the attributes of the SMART table, the imaging settings can be easily adjusted to records SMART table indices prior and after each imaging session.

Adjust the imaging settings to keep the record of SMART prior and after the imaging session.

By comparing the two tables, user can evaluate whether the health of a drive has been deteriorating throughout the imaging session and thus assess how quickly its health has been getting worse. Any discrepancies between the two SMART tables will be highlighted in yellow.

How SMART table state changed after image acquisition

Whenever you need to evaluate how the state of the drive has been changing long-term, go to previous imaging sessions and look up SMART table. TaskForce stores this information in its case management system.

Creating a new E01 file

1. Go to Image.
2. Select the source evidence drive.
3. On the Select target devices panel, click Select file.
4. In the file selector, find the folder to store the image and click Create file.
5. In the Create image file dialog, select the E01 file type.
6. Fill in E01 file information, and then click Create.
7. On the Select target devices panel, click Continue.

Creating an E01 file.

Enable dual-hash and start imaging

1. Once you have selected the source drive and created the target file, you end up on the Settings summary page. To adjust the imaging settings, click Change.
2. On the Hashes tab, make sure that Hash source during imaging is selected, also select both MD5 and SHA1 hash types.
3. To proceed with imaging, click Start.

Adjusting imaging settings.

The report and the E01 file

Upon completion of imaging, you can see both MD5 and SHA1 hash values indicated in the Imaging completed report.

Imaging report.

It is also possible to look up the information of the created E01 file. To do that, perform the following actions:

1. Click Devices at the top right.
2. Expand the File section and click Select file.
3. Choose your file. TaskForce opens the file information page with all the metadata of the E01 file. The MD5 and SHA hash values are listed there, too.

E01 file with calculated MD5 and SHA1 hashes.

Set a device to the Storage mode

To set a target device to the Storage mode:

1. Go to Image.
2. Select the source evidence drive.
3. On the Select target devices panel, switch to the Files tab and click Create file.

Selecting a target file.

4. In the Select image file window, click Add storage.

Adding a storage drive.

5. On the Select device panel, choose the drive you want to use in the Storage mode. TaskForce uses a lighter shade of blue to indicate that a storage drive is being configured.

Selecting a storage drive.

6. If TaskForce cannot find the appropriate exFAT partition on the selected drive, it offers you to format the device accordingly. In that case, select Format device to exFAT and click Next.

Formatting the target to exFAT.

7. To launch target device formatting to exFat with a large cluster size (32 MB), click Format and enter YES for confirmation. This cluster size enables faster imaging to this drive.

Formatting the target to exFAT.

Once the target device is formatted, TaskForce perceives it as a Storage target.

The drive in the Storage mode is marked with a special blue icon on the Select target devices panel.

A drive in the Storage mode.

Create a compressed E01 image file

To proceed with creating a compressed E01 image file on the storage device, do the following:

1. In the Select image file window, select the storage drive and then click + Create file.

Adding a new file.

2. In the Create image file dialog, enter the file name and select the E01 file type.

Creating an image file.

3. Select the Compress E01 option.
4. Fill out other file details, and then click Create.

Configuring the compressed E01 file.

5. Check your imaging settings and click Start to proceed with imaging.

The imaging settings screen.

The Imaging completed report provides all the time stamps, hash values, and hash verification result. To look up the settings of the imaging session, you can also see the Imaging started report in the case management system.

The Imaging completed report.

Create an AFF4 file as an imaging target

1. In the TaskForce main window, click Image.
2. Select a source device.
3. Optional: On the Imaging sessions page, click Start new.
4. On the Select target devices panel, switch to the Files tab and click Create file.

Creating a file as an imaging target.

5. Choose a folder for your file. You can save a file:
• on a computer or server in your local network or
• on a storage device connected to your TaskForce.
6. After selecting a folder, click Create file.
7. In the Create image file dialog, change file Type to AFF4.
8. Define hashing type and compression algorithm for your target AFF4 file:
• Block hashes: choose from MD5, SHA1, MD5 + SHA1, SHA256, or SHA512
• Compression: choose from LZ4, Snappy, or Not compressed.
9. Enter other case details and then click Create.

The settings for AFF4 target image file.

10. Click Continue.
11. Check imaging settings, change them if needed, and then click Start.

TaskForce starts imaging your evidence device to an AFF4 target file. After imaging is finished, the system shows an Imaging completed report.

The Imaging completed report with an AFF4 file as a target.

Create template

To configure a template for target image files, do the following:

1. On the Taskbar, click Image and select your Source device.
2. On the Select target devices panel, switch to the Files tab and in the Templates section click Add Template.
   

   Adding a template from the 'Select target device' panel.

3. The Add template dialog opens.
   

   The 'Add template' dialog.

4. To edit the template's name, click the Pencil icon next to it.
5. Specify a Target folder by clicking Select folder and choosing the desired location.
6. Set up a Subfolder path and Name template for your target files using constants (such as department name) and available variables:
   1. Year: YY (two-digit format) or YYYY (four-digit format).
   2. Month: MM (two-digit format).
   3. Day: DD (two-digit format).
   4. Current time: hh-mm (24-hour format).
   5. Case ID: CASE_ID (as specified in the TaskForce case system).
   6. Drive model: MODEL (acquired automatically by TaskForce during identification).
   7. Drive serial number: SERIAL (acquired automatically by TaskForce during identification).

   Variables are highlighted with pale green for better visibility.

   To create nested folders in the specified Target folder, use the forward slash symbol (/) in the Subfolder path field.

7. Select the target file Type: E01, AFF4, IMG, DD, or RAW.
   

   Selecting target file type for a template.

8. Optional: Configure additional parameters of a target file:
   • For E01 files: Segment size and Compression.
   • For AFF4 files: method for Block hashes (MD5, SHA1, MD5 + SHA1, SHA256, SHA512) and Compression algorithm (LZ4 or Snappy).

9. Choose how to fill in file metadata: automatically (default) or manually.

   If you choose Automatically, specify the values for Case ID, Investigator’s name, Evidence number, Description, or Notes.

   

   Option to fill in file metadata automatically.

   If you choose Manually, TaskForce will ask you to enter file metadata whenever you create a target file using the template.

   

   The 'Set file metadata' dialog.

10. When all the parameters of the template are set, click Create.

Use template

To create a target image file using an existing template, after selecting a Source device, simply click your template on the Select target devices panel.

After that, TaskForce creates the required subfolder(s) and adds a file with the specified parameters as an imaging target.

The target file appears on the Files tab of the Select target devices panel.

Then you can proceed to the Imaging settings screen by clicking Continue.

A template for target image files on the 'Select target device' panel.

Edit or delete template

To edit or delete a template for target image files, use the three-dots icon next to the template’s name on the Select target devices panel.

Editing or deleting a template for target image files.

Create encrypted storage

To image into files on an encrypted target drive, connect the source drive to a port in the Source mode and take these steps:

1. In the TaskForce main window, click Image.
2. Select a source device.
3. Optional: On the Imaging sessions page, click Start new.
4. On the Select target devices panel, switch to the Files tab and click Create file.
5. In the Select image file window, click Add storage.

6. On the Select device panel, choose the drive connected to a port in the Target mode.
7. Select Create an encrypted VeraCrypt container (exFAT) and click Next.

8. Enter and confirm the password for the encrypted volume on the drive. Then click Create.

9. Confirm the formatting of the device by entering YES and clicking OK. After this step, the formatting takes a few seconds.
10. Click + Create file.
11. Enter the name of the image file and choose the file format (E01, raw, img or dd). Then click Create.

12. Once you have created the file, you may add more image files in the same or a different folder.

After you click Continue, TaskForce images the evidence into the file on your encrypted target.

Upon completion of the imaging session, check the Imaging completed report.

Extract data from an encrypted volume

To find the VeraCrypt volume and the imaged file, do the following:

1. Plug the target drive into your computer.
2. Use VeraCrypt software to safely access encrypted data from your drive.
3. Select the drive label (A, B, C, etc.) on which you want the volume to be mounted.
4. Click Select device.
5. In the pop-up window, select your encrypted volume.
6. Click Mount. Now you can view the partition name, size and encryption algorithm.
7. Use the password set prior to the imaging session to get access to the encrypted volume.

After you enter the password, the volume is mounted and you can access it from Windows Explorer and use the image for subsequent operations.

Manage custom presets

To create a custom preset:

1. Go to Image and select source and target devices.
2. On the Imaging settings page, click Change.
3. Change the imaging settings.
4. Click the three-dot icon in the bottom right corner and choose Save to.
5. In the dialog window, enter the name of the preset and click Save.

Saving a preset.

Once you have saved a preset, they are stored in TaskForce's work folder and can be used by other operators using the same imager. They can find the presets you created under the Custom button.

The Chrome browser of the user who created a preset, saves a copy of the preset locally. When this user opens the Custom menu, both presets are displayed:

• one is the preset saved in TaskForce's work folder,
• another one is the local copy.

If one becomes redundant, it can be easily deleted.

All custom presets.

To delete a preset:

1. Select the preset in the Custom menu.
2. Go to the three-dot menu in the bottom-right corner and click Delete.

Share presets with another TaskForce

Once you have created your custom presets, you can share them with colleagues who use another TaskForce imager.

To export a preset:

1. Select the preset from the Custom menu.
2. Click the three-dot icon.
3. Click Export.

The preset will be downloaded in .json format.

Exporting a preset.

To import a preset:

1. Click the three-dot icon.
2. Click Import.
3. In the Import settings window, click Select file.
4. Find the file in the file selector and click Open.
5. Double-check the preset and click Import.

Importing a preset.

After this import, the preset can be found in the Custom menu.

Diagnose first

The built-in diagnostics module of TaskForce automatically checks all major subsystems of the evidence drive: circuit board, heads, media surface, firmware and file system.

A diagnostics report provides detailed information about the heads. In addition, it offers recommendations for the optimal imaging strategy for your damaged hard drive.

Diagnostics completed

The above diagnostics report informs the operator that the drive’s hardware has major issues and points to defects in the media and a damaged head (Head#3). The report contains a recommendation to disable the damaged head in the imaging settings.

Selective head imaging

Atola engineers recommend that the good heads are imaged first. To do that:

1. Go to Image.
2. Select your source and target devices.
3. Click Continue.
4. If a head was identified as damaged during the diagnostics, at this stage TaskForce shows a dialog prompting you to disable the damaged head. To confirm that the head should be automatically disabled for the subsequent imaging session, click YES.

Alternatively, the damaged head can be disabled in the imaging settings:

1. On the Imaging settings page, click Change to adjust the settings for your imaging session.
2. In What to image section, click on All sectors to configure the selective imaging.

3. Unselect the damaged head and сlick Save.
4. To launch your imaging session, click Start.

Multipass imaging algorithm

As you can see in the screenshot below, some errors were found in the course of imaging on the space of the drive that is read with the Head#4. It is common for a drive with a bad head to also contain errors on the platters that are read with other heads.

TaskForce uses its multipass imaging algorithm when encountering a bad sector that belongs to a good head. It allows handling errors and retrieving data from some of the bad sectors. For as long as it is possible to read data from the sector or block of sectors within the specified pass timeout, TaskForce will be able to image this data.

Having completed imaging from the good heads, the system pauses the session and produces a detailed imaging report with a log of all actions performed during the imaging session.

TaskForce allows editing settings of all unstarted imaging passes, adding or removing passes, etc. So if later you think you may be able to retrieve important data with Head#4, you can add another pass and configure the settings of the new pass accordingly.

TaskForce automatically inserts and launches an additional imaging pass after you click Resume on the pause session. The new pass will include all non-imaged sectors.

TaskForce automatically creates reports for every single action applied to each device connected to it. The reports are stored in the case management system.

Working with a bad head

After you successfully retrieved data from the good heads, you have two options:

• To replace the head stack before you get down to imaging of the remaining data. You should be aware of the risk, however, that data on the drive can become unreadable due to head stack replacement.
• To attempt imaging data with the Degraded or Damaged head.

To image the unselected bad head, simply click Resume.

TaskForce resumes the imaging session to focus on the area that belongs to the damaged head.

If the number of errors keeps growing, while the number of the imaged sectors remains unchanged, pause your imaging session and power down the drive because the head seems to be completely inoperable.

In the Imaging report above, you can see that TaskForce imaged 520,961,167 sectors out of 625,142,448, having extracted as much data from good heads as was possible with the default settings.

For more details scroll the report down to check the Log:

Diagnose first

Before imaging any evidence device, we strongly recommend diagnosing it.

To image an evidence drive without causing further damage to it, TaskForce is equipped with an automatic diagnostics module that evaluates the state of the drive, identifies specific errors and their location, and recommends the best approach for data acquisition.

The detailed diagnostics report contains detailed recommendations on how to acquire data from this particular drive, based on its condition.

The diagnostics report for a damaged device.

Preset for imaging damaged drives

If a device has issues or is damaged, TaskForce shows the respective tag next to it and suggests using the Damaged preset, designed specifically for imaging faulty drives.

In this case, the Damaged preset is automatically selected on the Imaging settings screen.

The default preset for bad drives is based on our decades-long experience in the data recovery market to overcome most types of damage to the drives. That's why we suggest that you use the Damaged preset for bad drives unless a particular drive requires a specific imaging approach.

The Damaged preset is selected on the Imaging settings screen.

To thoroughly retrieve maximum data from an unstable drive in a forensically sound way, the preset for damaged hard drives has several major differences from default imaging settings:

• Number of passes: 5 passes for damaged drives instead of 1 pass for good drives.
• Different timeouts for each pass: 1 second on the first pass, 5 seconds on the second, third, and fourth passes, and 60 seconds on the last fifth pass.
• Jump on errors: from 1,000,000 sectors on the first pass to only 1 sector jump on the last pass.
• Different read block sizes for each pass: 4,096 on the first, second, and third passes, 256 for the fourth and fifth passes.
• Segmented hashing with 4 GB segments instead of linear hashing used by default for good drives.

The Damaged preset for imaging faulty drives.

Multipass algorithm for imaging damaged drives

To approach bad drives in the most gentle way possible, TaskForce uses its special multipass imaging system.

Most forensic imagers can only do linear imaging, which dramatically slows down the imaging process whenever a bad sector is encountered, and, as a result, the drive may freeze. To speed up the imaging of damaged media and maximize the amount of successfully retrieved data, TaskForce has a special imaging algorithm that includes a deliberate timeout and block size control.

First pass

On the first pass, TaskForce allows a 1-second Timeout per block, and the Max read block size is set to 4096 sectors. This allows smooth sequential imaging of all healthy modern drives.

But when imaging damaged media, these settings let TaskForce skip any areas that slow down the process and perform Jump on error by 1,000,000 sectors at a time.

This way all the good areas of the drive are imaged at top speed, while forcing TaskForce to return to the problematic areas on the following passes, narrowing down the bad areas and allowing more time to retrieve the data within them.

Imaging the first pass. Empty areas where errors were encountered and jumps were performed.

Second and third passes

While the Max read block size remains the same during the second and the third passes, the Jump on error is set to 20,000 sectors and 4,096 sectors respectively, and slightly longer, 5-second Timeouts are allowed for attempted reading of the blocks.

Empty areas start filling up with data, as the jumps become smaller.

Fourth pass

On the fourth pass, both Jump on error and Max read block size are reduced to 256 sectors to try reading problematic zones in a more granular way.

The amount of data retrieved is already 99%.

Fifth pass

On the fifth pass, TaskForce allocates 60-second Timeouts to read the Maximum block size of 256 with just 1-sector Jump on error. It is the last and the most thorough attempt to retrieve data from the remaining bad areas of the drive.

The last pass has a unique feature that is not used during previous passes: an internal sector-by-sector auto-reread procedure for an error block. It is defined by an unchangeable Jump size = 1 sector.

How the imaging engine works on the last pass:

• It reads a block using the Max Block Size pass setting (256 by default).
• If the reading is successful, it proceeds to the next non-imaged block.
• If a read error occurs, the engine re-reads the whole error block sector by sector.

On the fifth pass TaskForce attempts to read the data for the last time.

After the final pass, the Imaging Results report will indicate the eventual number of errors on the drive and other detailed statistics.

The Imaging Results report shows the number of errors on the drive.

Customize imaging settings for each pass

To cope with a severely damaged drive, you can adjust the following parameters of any imaging pass:

• Timeout
• Jump on error
• Max read block address
• Start and end LBA
• Image in reverse direction
• Disable read look-ahead

Also, you can add or delete an imaging pass.

To customize settings for a certain imaging pass, do the following:

1. On the Imaging settings page, click Change.

The Change button on the Imaging settings page.

2. Click the pass you want to change.

An imaging pass is highlighted on the Imaging settings page.

3. In the Edit imaging pass window, enter new settings or toggle the options you need.
4. Click Save.

The Edit imaging pass window shows the current settings for the first pass.

Start and End LBA

For each pass, you can define the starting and ending sectors by entering logical block addresses in the respective fields (Start LBA, End LBA) or by dragging markers of the slider below.

Alternatively, you can select All sectors with data in the What to image field. It makes TaskForce search for all known partitions and image only the sectors that contain data. This option is a good use when you are facing a lack of time to take a full image.

Currently supported partitions: NTFS, ext4/3/2, XFS, Btrfs, APFS (with encrypted volumes), exFAT, HFS/HFS+, FAT32/16.

Image in reverse direction

With this function selected, TaskForce approaches skipped areas of the drive from the other side on any selected pass. That means the imaging engine reads a source drive backward and reaches the damaged areas from the opposite direction.

This way, the imaging module can retrieve more data from a drive before entering a damaged zone, which needs to be concentrated on during the following passes. But the speed decreases due to auto disabling of the drive's cache.

Hint: It is one of the best options we recommend you enable to get more data from a severely damaged drive.

Disable the read look-ahead mode

Most contemporary hard drives have a read look-ahead functionality, which makes the drive read more blocks sequentially than requested by software.

In good drives, this functionality helps the drive operate faster by reading more data and caching it.

But with bad drives, the read look-ahead feature leads to bad areas being addressed more often. This slows down the process and may lead to a complete freeze of the drive. In such cases, we recommend disabling the read look-ahead option.

Add a pass

You can add new passes even when an imaging session is not yet started or when it’s paused.

To add a new pass to an imaging session, do the following:

1. On the Imaging settings page, click Change.
2. Click Add pass.

Adding a pass.

3. Adjust the settings for the new pass.
4. Click Save.

Delete a pass

You can delete any pass that has not been started yet. To delete an imaging pass, do the following:

1. On the Imaging settings page, click Change.

The Change button on the Imaging settings page.

2. Click the pass you want to delete.

An imaging pass is highlighted on the Imaging settings page.

3. In the Edit imaging pass window, click the Delete icon and confirm the deletion.

Freeze detection and handling during imaging

Imagine that the drive is unable to read data from the damaged sectors and goes into a long-lasting retry mode before it gives up on a particular sector and returns an error.

If TaskForce simply waited for each Read sectors command to be completed:

• it would take ages to get an image of a drive with numerous errors;
• it could cause the drive to slip into complete freeze;
• in the worst-case scenario, further damage could be caused to the data on the drive.

The Reset command

To avoid causing further damage to the data on the drive and long waiting periods, TaskForce issues a Reset command whenever a drive attempts to read a block of sectors longer than allowed by the pre-configured timeout.

Reset is a device interface operation, using which TaskForce stops the previously sent Read sectors (or any other) command and then continues imaging from the next planned block on the drive.

If the device is still running the Read Sectors command, even after the first Reset attempt, TaskForce waits 3 seconds and performs the second Reset command. At the moment of the second Reset, a new entry appears in the imaging Log reading

Log entry: Device hangs while reading block X – Y.

Performing a power cycle

If 20 seconds after the second Reset command the drive still tries to read the bad block, TaskForce performs the Power cycle command by forcibly cutting power to the drive for 5 seconds.

At this point, TaskForce adds two entries to the imaging Log:

Log entry: Performing power cycle.

After a successful power cycle

In case the first Power cycle command is successful, and the drive become ready to accept the next command, there will be a final log entry for this problematic block of sectors saying:

And then TaskForce continues imaging from the next planned block.

After an unsuccessful power cycle

If the first Power cycle command is ineffective, and the drive is still in Busy state and can’t run the next command, TaskForce makes the second Power cycle.

If the second Power cycle does not help either, imaging is terminated. It can be resumed afterward, and TaskForce will continue to image all remaining sectors.

Freeze detection during diagnostics

TaskForce diagnostics module automatically checks the status of each head (for HDDs) and the condition of the media surface by reading several hundreds of thousands of sectors from the starting/outer, middle, and ending/inner part of the head or drive.

If a drive freezes, unable to read certain sectors, it may or may not be detected during diagnostics because not all sectors of the drive are being read at this stage.

If an HDD has a damaged head causing it to enter a busy state, a diagnostics report notifies you about that with the line

Notification “Device freezes when checking head N” in the diagnostics report.

Also, the diagnostics report shows a table with a freeze count and the number of read errors for each HDD head:

A table with a freeze count for a drive with a damaged head.

A table with a freeze count for a drive with good heads.

If the heads status is OK, but some freezes were detected during diagnostics, the result of the diagnostics show the following line:

The Diagnostics results notifying that the device sometimes falls into complete freeze.

How drives become shorted

Most drives are equipped with two TVS diodes to protect the circuit from overvoltage. One diode is located on the 5V rail and another on the 12V rail.

If the drive experiences an overvoltage, the diodes convert the excess electrical power into heat energy and warm up, thus protecting the drive's circuit. Similarly, in the case of reverse polarity, the diode warms up as it conducts the current in the opposite direction.

If the overvoltage or reverse polarity event is short and the dissipated energy is not too high, the diodes can recover and continue working. However, if the dissipated energy is too high, the diodes will "sacrifice" themselves and get shorted.

When the drive is subsequently powered, the shorted diodes create a low resistance connection between two nodes, known as a short circuit. This is exactly what happens to a drive when its TVS diodes are shorted.

Detect a shorted drive

When you connect a shorted drive to Atola TaskForce, the Home screen shows a short circuit alert to notify the operator about the detected issue.

The Home screen with a short circuit alert.

On the Select device panel, TaskForce marks the port to which a shorted drive is connected with the Short circuit tag and icon.

The Short circuit tag and icon on the Select device panel.

A drive with a shorted TVS diode cannot be identified, diagnosed, or imaged with TaskForce, until you replace or remove the diode.

Image a shorted drive

If you need to image a shorted drive but do not have new TVS diodes on hand to replace the shorted ones, you can image the drive using Atola TaskForce after removing the diodes. This process is safe because Atola TaskForce has short circuit and overvoltage protection, which guards both the imager and the drives connected to it against circuit failures.

To remove the diodes, heat the area of the drive where they are located with a hot fan (such as in a hot air soldering station) and then gently remove them with tweezers.

Once the diodes have been detached, you can plug the drive into Atola TaskForce and proceed with imaging data from it.

Configure Express mode

Before activating Express mode, you need to configure it first: specify the target folder, file image format, and other imaging details.

To open the Express mode settings page, click the Menu in the top right and select Express mode.

Choosing Express mode from the Menu.

TaskForce can process 17 self-launching imaging sessions in Express mode on almost all of its ports, except for the Extension slot. The ports that can be used for imaging in Express mode are:

• 6 SATA
• 6 SATA/SAS
• 4 USB
• 1 IDE

When activated, Express mode controls all source ports, leaving target ones available for other tasks. If a port is switched from target to source, it also becomes available for imaging in Express mode.

By default, Express mode settings are applied to all drive ports set to source. However, you can combine any number of TaskForce ports into a custom group with specific imaging parameters for Express mode. See Port groups for details.

Express mode settings.

What image files to create: type, compression, hash, templates and more

To set up the parameters of a target image file, such as file type, compression method, segment size, and hash type, on the Express mode settings page, find the What image file to create section and click Change.

Configuration dialog appears.

On the File tab of this dialog, configure the target image file.

On the Template tab, you can also create the templates for image file names.

Selected parameters apply to an active port group only. Here are the details about each parameter.

Image file type

In Express mode, drive images can be saved as RAW, E01, or AFF4 files.

To change the target image file type for a specific group of ports, select it from the Type list on the File tab.

Selecting target image file type.

Compression

TaskForce supports the default compression method for the E01 file format and LZ4 or Snappy compression methods for the AFF4 file format.

Choose the compression method from the respective list on the File tab. The Not compressed option is also available for both E01 and AFF4.

The RAW file format does not support compression.

Selecting the compression method for a target image file.

Segment size

For the E01 file format, TaskForce can split the target image into segments of predefined size. Each segment is stored in a specified folder as a separate file.

The Segment size list becomes available on the File tab when the E01 file type is selected. You can choose the segment size from the following options:

• Single file
• 4.7 GB (DVD)
• 8.5 GB (DVD DL)
• 25 GB (Blu-ray)
• 50 GB (Ultra HD Blu-ray)
• 100 GB (Blu-ray XL 3L)
• Custom (enter the segment size you want)

Selecting the segment size for a target image file.

Hash type

For AFF4 file format, TaskForce can calculate built-in block hashes during the imaging process in the Express mode.

To select the hash type you want to calculate, use the Block hash list on the File tab. The available hashing options for the AFF4 file format are:

• MD5
• SHA1
• MD5+SHA1
• SHA256
• SHA512

Selecting the hash type for a target image file.

Create template for image file names

To create a template for naming target subfolders and files according to your organization rules, find the What image file to create section, click Change, and switch to the Template tab. For details, see Target file templates.

Creating a template for a target image files names in Express mode.

Diagnose before imaging and Start imaging only if diagnostics has no issues

As essential as imaging speed is, the proper treatment of evidence drives remains a priority. That’s why we recommend that diagnostics is always performed as soon as a drive is connected to TaskForce for the first time.

To enable the automatic launch of imaging of the healthy devices and avoid potential deterioration of drives in a shaky condition, the Express mode settings have two handy options:

• select Diagnose source drive before imaging so that diagnostics start automatically,
• then select Start imaging only if diagnostics has no issues.

When enabled in Express mode, Atola’s signature automated diagnostics module checks all drive systems:

• hard drive’s motor and electronics (PCB),
• head stack,
• media surface,
• all firmware/system areas,
• partitions and file systems.

For more information about TaskForce’s diagnostics module, see Diagnosing a drive with Atola TaskForce.

Diagnostics options for Express mode.

Imaging presets

To ensure that all imaging sessions in Express mode fit your organization’s demands and procedures, in Express mode you can use one of the preconfigured imaging presets.

TaskForce has two built-in imaging presets, Default and Damaged, for good and bad drives respectively, but you can also create and configure your own preset. For guidance, see Imaging presets.

To select an imaging preset for Express mode, use the Type list in the Imaging settings preset section.

Changing the imaging preset is available only when Express mode is deactivated.

The 'Type' list in the 'Imaging settings preset' section.

Activate Express mode

Once Express mode settings are specified, click the Activate button and connect your evidence drives for an immediate start of imaging.

If any drives are already connected to the source ports, TaskForce starts to image those devices immediately using Express mode settings once you click Activate.

To indicate that TaskForce now operates in Express mode:

1. In the user interface, the color of the top panel and the Image icon on the left changes.


2. On the TaskForce’s IP screen, the message “Express mode” appears.

Image drives in Express mode

Change drives

Once an imaging session in Express mode is completed, TaskForce powers the respective port off and prompts a user to plug in the next evidence device.

To start a new imaging session, plug in the next source device and click Continue in the dialog.

Deactivate Express mode

To deactivate Express mode:

1. Click the Menu in the top right and select Express mode.
2. On the bottom of the Express mode settings page, click Deactivate.

To show that Express mode is deactivated, TaskForce changes the color of the top panel and the Image icon on the left back to normal. The message “Express mode” on the IP screen also disappears.

Key features of logical imaging in TaskForce

• 25+ parallel logical imaging sessions.
• Pause/Resume for each session.
• L01 or ZIP target images created in a network folder or on a storage drive.
• Compression of a target file is available.
• Supported file systems: NTFS, ext4/3/2, XFS, Btrfs, APFS (with encrypted volumes), exFAT, HFS/HFS+, FAT32/16.
• Smart include/exclude filters.

Start logical imaging

There are two ways to start the Logical imaging module in TaskForce.

• From the Homescreen: On the Taskbar, click the Logical icon.


The Logical icon in the Taskbar.

• From the RAID module: On the RAID Configuration page, click the Go to logical button. For details, see Logical imaging of a RAID array.


The Go to Logical button on the RAID configuration page.

Logical imaging workflow in TaskForce

Once you started the Logical imaging module, follow these steps to create a logical image of your source device:

1. Select your source device.
2. Select partitions, folders, or files to image.
3. Apply smart filters, if needed.
4. Select target file.
5. Optional: Pause and resume the imaging process.
6. View the logical imaging report.

Let’s see in detail how to perform each step.

Select source device

After clicking the Logical icon on the Taskbar, select your source device.

TaskForce supports the following source types:

1. Individual physical drive:
   • SATA,
   • SAS,
   • NVMe,
   • USB,
   • IDE,
   • drives with M.2 interface within Apple laptops using the Apple PCIe SSD extension module,
   • Apple MacBooks with FireWire, Thunderbolt 2, and Thunderbolt 3 interfaces using the Thunderbolt extension module.
2. Image files:
   • IMG, RAW, DD
   • E01
   • AFF4
3. Reassembled RAID arrays.

File systems, supported by the Logical imaging module, are NTFS, ext4/3/2, XFS, Btrfs, APFS (with encrypted volumes), exFAT, HFS/HFS+, FAT32/16.

Selecting a source device for logical imaging.

Select partitions, folders, or files to image

After you select your source device for logical imaging, TaskForce takes you to the Logical imaging page. Here you can preview the content of available partitions and folders, apply smart filters or use presets with predefined filtering settings.

Your source device and its case ID are shown at the top of the page.

Selecting partitions, folders, and files for logical imaging.

Use smart filters and presets for selecting folders or files

Automatically include or exclude folders and files for imaging by using the built-in smart filters or custom filtering presets.

The Filters section on the right provides flexible options for fine-tuning your selection of folders and files for imaging.

By default, TaskForce images all files from all partitions.

Apply filters

Use smart filters to automatically include or exclude specific files or folders:

1. In the Filters section, select the Custom option from the list.

2. Click the Include or Exclude button. The respective dialog appears.

3. Automatically include or exclude folders:
   1. In the respective dialog, select the Folders option from the list at the top.
   2. Click in the Folders field.
   3. Select one of the predefined options: User folders or OS folders.
   4. Or enter the folder paths, separated by commas.
   5. Click Apply.

4. Automatically include or exclude files:
   1. In the respective dialog, select the Files option from the list at the top.
   2. Specify File types by selecting predefined options from the list: archives, audio, databases, documents, emails, financial, pictures, security keys, video, and virtual machines. You can enter file extensions yourself as well.
   3. Enter file size range: from 1 byte to infinity.
   4. Narrow down time spans: when files were modified, accessed, or created.
   5. Click Apply.

All applied Include or Exclude filters appear in the Filters section.

Check filters before imaging

To test your filtering settings before imaging and get a list of files that match the selected filters, click Check at the top of the Filters section:

TaskForce scans the selected partition(s) and lists all files matching the filtering criteria. You can download this file list in CSV format by clicking the Download button at the bottom.

Downloading the list of files matching the filtering criteria.

Save filtering settings as a preset

To reuse your filtering settings later or share them with your colleague, save them as a logical imaging preset:

1. In the bottom right corner of the Logical imaging page, click the More icon with three dots.
2. Select Save to.
3. Enter the name for your preset and click Save.
   

   Saving a logical imaging preset.

From the same three-dots menu, you can also:

• Export a preset to use it on another computer.
• Import a preset created on another computer.
• Delete a preset.
  

To switch between presets, use the Current settings list on the bottom right of the logical imaging page.

Selecting a preset from the Current settings list.

Select target file

Once you have adjusted the logical imaging parameters, click Continue.

TaskForce takes you to the Select target folder window.

The target file in L01 or ZIP format (with or without compression) can be created either on a network drive or on a storage device connected directly to the TaskForce hardware unit:

1. Select the folder for your target file and click Create file.


The Select target folder window.

2. Adjust the settings of the target file:
   1. Name.
   2. File type: L01 or ZIP.
   3. Hashing method (Digest type): MD5, SHA1, or MD5+SHA1.
   4. Compression.
   5. Case ID and details.
3. Click Create to start the imaging process.


Creating logical imaging file.

Logical imaging process. Pause and resume

The logical imaging process starts immediately when you click Create in the Create logical image file dialog.

Once imaging is launched, TaskForce creates a Logical imaging started report. It contains all details about the imaging source and target(s), as well as information about the include or exclude filters. You can find this report on the Home screen, on the Case page, or the Reports page.

A Logical imaging started report.

During the imaging process, you can track the progress of individual files.

To check the filtering parameters of this running session, click View filters at the bottom of the page.

The logical imaging process.

Pause and Resume

TaskForce lets you pause any logical imaging session and resume it later:

1. While the logical imaging process is running, click the Pause button at the bottom of the page.
2. To resume a session, click Logical on the Taskbar and then select your source device.
3. On the Recent logical imaging sessions page, click Resume next to your session.

Resuming the logical imaging session.

Logical imaging completed report

After the logical imaging process is completed, TaskForce generates a comprehensive report with all the details of the imaged data:

• The number of scanned and imaged files
• The volume of imaged data
• Time stamps
• and more

You can find this report on the Home screen, on the Case page, or on the Reports page.

The 'Logical imaging completed' report.

When source drive is damaged

Use these imaging settings and follow the recommendations to cope with severely damaged drives.

Faster imaging

If you want to speed up image acquisition, follow these hints.

Assembling a RAID 0 with unknown configuration

1. Connect the drives to the TaskForce hardware unit's ports that are switched to the Source mode.
2. On the left in the TaskForce main window, click RAID.

3. On the Select source device panel, select the drives that make up a RAID array and click Continue.

Selecting source RAID drives.

You can see key RAID configuration parameters at the top of the page:

• Order of drives/images
• RAID type
• Start LBA
• Block size
• Block order

Before you enter other values either manually or by applying Autodetection module results, the most commonly used values are displayed in the given fields.

The Autodetection module starts running immediately.

RAID 0 autodetection

Stage 1: TaskForce is reading data on the drives to identify the RAID type.

To change the order of drives in the array, simply drag a drive to its new position. To remove a device from the current array, grab it and put it into the bin.

Analyzing devices.

Stage 2: TaskForce goes through thousands of possible variants of RAID parameters.

Click Apply as soon as a Possible configuration tile appears.

Possible RAID configuration.

After you click Apply, TaskForce automatically applies the suggested configuration and checks the file system for partitions. At the bottom of the screen, a preview of the partitions is available.

Observing files and folders in the preview confirms the detected RAID 0 configuration is correct.

Imaging RAID 0 array

1. After RAID configuration is successfully applied, click Go to Image to proceed with imaging.

The Go to image button.

2. Select your target device or network folder and click Continue.
3. To launch your imaging session, click Start.

RAID imaging may take much longer than imaging a drive. You can optimize the imaging speed by using a fast target or a high-speed server.

How to make raid image.

TaskForce automatically generates reports for every session. The Imaging completed report will contain all RAID details as well as timestamps.

The Imaging completed report.

Autodetection of RAID 5 configuration

1. Connect the drives to the TaskForce hardware unit's ports that are switched to the Source mode.
2. On the left in the TaskForce main window, click RAID.

Initiating work with RAID.

3. On the Select source device panel, select the drives that make up a RAID array and click Continue.

Selecting the drives that make up a RAID.

To assemble a RAID from images instead of drives or to use a combination of drives and images, on the Select target devices panel, expand the File section and click Select file. Then browse and select images.

After you selected the drives that make up a RAID array, TaskForce redirects you to the RAID configuration screen. It consists of three parts:

• The selected devices (and/or image files) are shown in the top RAID configuration part.
• The RAID Partitions viewer below it provides a preview of partitions and files within them, once RAID has been successfully assembled.
• The Autodetection module in the right-hand part of the screen immediately starts running and produces an output of RAID configuration suggestions.

Autodetection module reads data from all the selected devices and/or images to detect these RAID parameters:

• Order of drives/images.
• RAID type.
• Start LBA.
• Block size.
• Block order.

Should the configuration be known, these parameters can also be set manually by the operator.

The time required for configuration detection can vary from a few seconds to a few hours depending on the numbers of drives involved, RAID volume and type, and how metadata is distributed on the drives in the RAID. In certain cases, Autodetection may produce several configuration suggestions, which can be applied one by one to find the exact match. TaskForce's Autodetection is based on heuristics algorithms that help speed up the variant check.

4. Click the Apply button to apply the configuration suggested by the Autodetection module.

Autodetection module searching for possible RAID configurations.

If the suggested configuration matches the RAID native configuration, partitions of the RAID will be displayed and a preview of data within the partition will be enabled.

Detected RAID 5 configuration applied

Imaging selected partitions of RAID 5

1. To adjust the imaging settings and define the target for the image, in the left bottom corner of the screen, click Go to image.
2. Select the target for the imaging session. Both a local server and a target device in Storage mode can be used for imaging of a RAID array.
3. Click Create file.
4. In the Create image file dialog, fill out the image details and click Create.

Imaging RAID. E01 details.

5. On the Settings page, click Change and then click the settings of an imaging pass.

Imaging settings.

6. In Edit imaging pass dialog, select the individual partitions to be imaged if selective imaging is required and click Save.

Selecting partitions in imaging settings

7. To launch the imaging session, click Start.

TaskForce will be imaging RAID 5 array or its partitions as configured in the imaging settings.

Imaging RAID 5 in progress

At the end of the imaging session, TaskForce produces an Imaging completed report with all the details of the source drives, the RAID configuration, the target, the partition, the timestamps, etc.

RAID 5 forensics. Imaging report

Reassemble RAID 5

1. Connect the drives to the ports of the TaskForce hardware unit. Make sure the ports are in Source mode.
2. On the left in the TaskForce main window, click RAID.
3. Select the drives that make up the RAID array.
4. Click Continue.

Selecting RAID members

Detecting errors

The TaskForce autodetection module starts running immediately, after you select the RAID devices.

Stage 1: TaskForce reads data on the drives to identify RAID type. If it runs across an error, TaskForce displays error tags next to the respective RAID member.

To see the number of errors encountered on a RAID member, simply hover the cursor over the error tag.

Error tags

Stage 2: TaskForce goes through thousands of possible RAID configurations to identify a suitable one.

Once the configuration is detected, click the Apply button.

Applying the suggested RAID configuration

After you click Apply, TaskForce automatically applies the suggested configuration and checks the file system for partitions.

Despite read errors, TaskForce can mount the partitions for preview by rebuilding the data in the bad sectors using data redundancy inherent to this RAID type.

Imaging RAID 5 array with errors

1. After RAID configuration is successfully applied, click the Go to image button to proceed with imaging.

2. Select your target device or folder and click Continue.
3. To launch your imaging session, click Start.
4. When the TaskForce system encounters an error, it automatically reconstructs the missing data, using the data in the parity blocks on the remaining RAID members.

Coping with errors.

Thus TaskForce can recover the full image. No operator involvement is necessary.

Imaging RAID 5 array.

Imaging report

TaskForce automatically generates the Imaging completed report with all RAID details and timestamps.

TaskForce managed to successfully reconstruct and image all the data. That is why the number of errors in the Imaging completed report is zero.

Imaging report.

Autodetection of the mdadm-created software RAID

1. Connect the drives to ports in Source mode.
2. On the left in the TaskForce main window, click RAID.
3. Select the drives that make up a RAID array and click Continue.

Autodetection module has instantly recognized and applied the RAID configuration. TaskForce automatically identifies mdadm-created RAID arrays with great precision by detecting controller metadata.

This RAID’s Start LBA is different from 0. TaskForce’s autodetection module is trained to detect this parameter for different types of RAID arrays and mdadm versions.

A partition is displayed in the bottom part of the screen, confirming that the applied configuration is correct.

Forensic RAID reconstruction.

Imaging the mdadm-created RAID array

1. To proceed with imaging the assembled RAID, click the Go to image button.
2. Select the target and click Continue.
3. Click Start and confirm the overwriting of data on the target.

The imaging session runs as fast as the target speed allows.

The imaging report contains all the RAID details and timestamps.

Imaging report for an mdadm-created RAID.

Create logical image of a RAID array

1. On the RAID Configuration page, click the Go to logical button.

The suggested RAID configuration applied, partitions preview shows partitions.

2. In the Logical imaging module, adjust your selection if needed.

Specify the partitions, files and folders to included or excluded in the imaging.

By default, logical imaging is set to image all files from a drive or a RAID. To fine-tune your selection, include or exclude what you need:

• All or selected partitions.
• Manually selected files or folders.
• Specified file types: archives, emails, documents, databases, financial, virtual machine, audio, video, pictures, security keys.
• Folder types: only user or only OS folders.
• Time spans: when files were accessed, created, modified.
• File size: from 1 byte to infinity.

Multiple search parameters allow you to fine-tune your selection.

3. Once you have adjusted the logical imaging parameters, click Continue.
4. Select the Target for your L01 file and click Create file.
5. Adjust the settings of the L01 file and click Create to start the imaging session.

Settings of an L01 file.

When the imaging is running, you can track the progress of imaging of the individual files. As for the overall imaging progress, the upper graph indicates the amount of imaged data as related to the whole space of the RAID volume, not to the selected volume.

Logical imaging of a RAID array.

Imaging report

TaskForce generates the Imaging completed report with all the details of the imaged selection from this RAID:

• The number of scanned and imaged files
• The volume of imaged data
• Time stamps

Imaging completed report of a logical imaging session

Imaging started report is created the moment the imaging launched: it is a detailed report of all the settings including the elements selected for this acquisition (partitions, files and folders).

Imaging started report of a logical imaging session.

Image selected partitions

To image only selected partitions of an assembled RAID array, do the following:

1. On the RAID configuration page, click Go to image.

The suggested RAID configuration applied, partitions preview shows partitions.

2. Select your target device and click Continue.
3. On the imaging Settings page, click the imaging pass to adjust the imaging range.

The suggested RAID configuration applied, partitions preview shows partitions.

4. In the Edit imaging pass dialog, click on the What to image and select Sectors with data.

Selecting only sectors with data from the What to image list.

5. Unselect the partitions you do not need and click Apply. Then click Save to keep this change.

Select partitions for imaging

6. To launch your imaging session, click Start.

The suggested RAID configuration applied, partitions preview shows partitions

Imaging report

TaskForce generates the Imaging completed report with all the details of the RAID:

• The imaged range.
• Time stamps.
• A link to the file with the segmented hash, calculated for the imaged range.

The Imaging completed report

RAID types comparison

RAID type and method	Scheme of data distribution	Description	Common usage	Performance	Fault tolerance	Capacity	Minimum number of disks
JBOD: Spanning		Multiple physical drives are spanned, or concatenated, together to form a single logical disk with no redundancy.	Increasing capacity. Cost-effective storage with no performance or security benefits.	No benefits. Array performance equals the performance of each drive depending on data location.	Very low. Redundancy is not provided. If one drive fails, a failure is typically isolated to this drive.	Array capacity is the sum of the capacities of its members.	2
RAID 0: Striping		Data is split ('striped') evenly across the drives forming a logical array, without parity or mirroring.	Improving reading and writing speed.	The highest read and write speed because data is striped across all disks, and the controller can read and write several drives in parallel with no delay due to parity calculation.	Very low. If one drive fails, data is lost.	Volume is the sum of the capacities of the drives in the set. No overhead is provided by parity blocks.	2
RAID 1: Mirroring		Mirroring without parity or striping. Data is written identically to two or more drives, producing a "mirrored set" of drives.	Standart app servers; applications that require higher fault tolerance, than storage capacity or performance.	High read speed: the controller can read several drives in parallel. Lower compared to RAID 0 write speed: all data must be written to two disks.	High. If one drive fails, data is restored from the “mirror” drive(s).	Storage capacity is reduced by 1/2 as all data is written twice.	2
RAID 10 (1+0): Striping and mirroring		Striped set from a series of mirrored drives. Data is shared between disks and duplicated.	Highly utilized database, email, web servers.	High read speed similar to RAID 1 due to improved read rates through simultaneous disk reads.Moderate to high write speed because data is mirrored across pairs, but the striping allows for higher write speeds compared to just RAID 1.	Very high fault tolerance. The array can sustain multiple drive losses so long as no mirror loses all its drives.	Storage capacity is reduced by 1/2 as all data is written twice.	4
RAID 5: Striping and parity		Data is split ('striped') evenly across the drives with added distributed parity.	Normal file storage and app servers.	High read speed but slightly lower than RAID 0 because of the overhead from parity calculations and distribution across all disks. Moderate write speed due to the need for parity calculations and writing both data and parity information.	High. If one drive fails, data can still be calculated from the distributed parity.	Due to parity blocks, storage capacity equals the smallest drive capacity multiplied by (N−1) drives.	3
RAID 6: Striping and double parity		Data is split ('striped') evenly across the drives with two distributed parity blocks, instead of one.	Large file storage and app servers.	High read speed similar to RAID 5, but can be slightly slower due to additional parity calculations. Write speed is lower than RAID 5 because it requires two parity blocks to be written.	Very high fault tolerance due to double parity. Data can still be calculated even if two drives fail.	Due to dual parity blocks, storage capacity equals the smallest drive capacity multiplied by (N−2) drives.	4

RAID parameters

Each individual RAID is defined by a combination of several main parameters:

• RAID type (or RAID level)
• Number of devices
• Device order
• Start LBA (or Disk offset)
• Block size
• Block order
• Parity block order
• File system

To identify RAID type and exact parameters, TaskForce automatically checks up to 200,000,000 RAID parameter combinations. However, if you know the exact RAID configuration, you can enter it manually.

Depending on the RAID type, different sets of parameters can be applied:

Here’s what each of the RAID parameters means.

RAID type (or RAID level)

RAID type is defined by the method in which data is distributed across physical drives combining the array. TaskForce currently supports the following RAID types:

• JBOD
• RAID 0 (Stripe)
• RAID 1 (Mirror)
• RAID 10 (Stripe of mirrors)
• RAID 5 (Distributed parity)
• RAID 6 (Dual parity)

In TaskForce, the RAID type can be automatically identified by the Autodetection module along with other parameters.

However, if you know the RAID type, you can select it manually from the RAID type list in the RAID configuration section.

The RAID type list in the RAID configuration section.

Number of devices

Applies to: all supported RAID types.

The minimum number of disks needed to build a RAID array is:

• two for JBOD, RAID 0, and RAID 1,
• three for RAID 5,
• four for RAID 10 and RAID 6.

The actual number of RAID members is determined by you when you select in the TaskForce RAID module physical disks (SATA/SAS/USB drives) or their images (raw, E01 or AFF4 image files) as Sources that make up a RAID array.

Selecting source RAID drives.

Missing RAID members. For the RAID types that use redundancy (parity blocks), TaskForce can reassemble an array and create its image even with a missing device:

• with one missing device for RAID 5 that uses distributed parity,
• with two missing devices for RAID 6 that uses double distributed parity.

See RAID 5 with a missing drive for more details.

Adding missing RAID 5 drive.

Device order

Applies to: all supported RAID types.

The drive order is the order in which physical devices (or their images) follow each other within a logical array (think pages within a book). That order is defined by a RAID controller during the setup of an array. To reassemble and image a RAID array, you need to determine which of its members go first, second, third and so on.

In TaskForce, the drive order can be automatically detected by the Autodetection module along with other parameters.

However, if you know the drive order, arrange the RAID members manually by dragging them up or down in the RAID configuration section of the TaskForce RAID module.

Start LBA (or Disk offset)

Applies to: all supported RAID types.

LBA stands for Logical Block Address. It is a scheme used for addressing a particular area on a storage device in a linear way using sequential integer numbers, starting from zero: 0, 1, 2, 3… Thanks to LBA a single drive or a RAID controller identifies the exact location of bytes it needs to read from or write to.

When we talk about RAIDs, Start LBA, also known as Device offset, refers to an address of a logical block on each physical RAID member where user data begins. Start LBA of each member of the same RAID is identical.

If RAID’s Start LBA is 0, RAID blocks (chunks) start from the first logical block on each drive in an array, without any offset (it is the most common case).

If RAID’s Start LBA is greater than 0, a space created by this offset is skipped. RAID blocks start from the specified Start LBA on each drive in an array. Typically, the skipped space can be used to store RAID metadata (data about data).

In some cases, TaskForce can identify RAID’s Start LBA during autodetection using a heuristic algorithm.

If you know Start LBA, you can enter it in the Start LBA field of the RAID configuration section.

 

When we talk about logical partitions, Start LBA refers to the logical block address where a particular partition starts in an already assembled RAID array. In this case, Start LBA of each partition is different.

Block size

Applies to: RAID 0, RAID 10, RAID 5, RAID 6 (types that use striping method).

Some RAID types use striping method for distributing data across physical drives: data is split into consecutive logical blocks (also called “stripes” or “chunks”), which are stored on different physical storage devices.

The Block size parameter in TaskForce RAID module refers to the size of these logical blocks (or “stripes”) measured in bytes. TaskForce supports RAID block sizes from 512 bytes to 1 megabyte and can detect that parameter automatically using a heuristic algorithm. The most frequently used block size is 64 kilobytes.

If you know the block size of a RAID, you can select it manually from the Block size list in the RAID configuration section.

Block order

Applies to: RAID 5, RAID 6 (types that use block-level striping with distributed parity).

The Block order parameter defines the layout (or pattern), in which RAID logical blocks (“stripes”) are distributed among the devices in the array. It is the sequence of writing data and parity blocks across the RAID members and depends on:

1. The direction of data blocks writing: left to right or right to left on the disk array.
2. The placement of the parity blocks: at the beginning or the end of the stripe.
3. The location of the first block of a stripe relative to the parity of the previous stripe.

For RAID 5, the Block order parameter can be:

• Left symmetric. This is the default RAID 5 layout under Linux.
• Left asymmetric. This is the 'standard' RAID 5 layout.
• Right symmetric.
• Right asymmetric.

For RAID 6, the Block order parameter can be following:

File system

After reassembling RAID using other parameters, TaskForce automatically identifies its file system and shows a preview of its partitions, folders, and files.

Currently supported file systems are: .

The preview of the RAID file system with partitions, folders, and files.

JBOD

JBOD is an abbreviation of "Just a Bunch Of Drives" and refers to a method for concatenation (or spanning) of multiple physical drives into a single logical disk with no redundancy. Data is written consecutively, from the beginning to the end of the first drive, and then spans to the second, the third and so on.

JBOD provides cost-effective storage with no performance or security benefits. It needs at least 2 drives to function. Array capacity is the sum of the capacities of its members.

If one drive fails, all data stored across the entire array may be compromised or lost, as JBOD does not implement any form of redundancy or fault tolerance.

JBOD advantages:

• Increasing capacity.
• Cost-effective storage.

JBOD disadvantages:

• No performance benefits.
• Redundancy is not provided.

JBOD parameters

When reassembling JBOD in Atola TaskForce, the following parameters are available for manual selection:

• Device order
• Start LBA

RAID 0 (Stripe)

In RAID 0, data is evenly distributed into stripes across two or more drives, forming a logical array, without parity or mirroring. RAID 0 provides higher reading and writing speed, as it can read and write multiple drives in parallel. As RAID 0 does not use mirroring or parity blocks, there’s no redundancy and fault tolerance: if one drive fails, data is lost.

RAID 0 needs at least 2 drives to function. Array volume is the sum of the capacities of the drives in the set, there’s no overhead provided by parity blocks.

RAID 0 advantages:

• Highest reading and writing speed.
• No overhead provided by parity blocks.
• Maximum capacity: sum of all RAID members.

RAID 0 disadvantages:

• No fault tolerance: if one drive fails, data is lost.

RAID 0 parameters

When reassembling RAID 0 in Atola TaskForce, the following parameters are available for manual selection:

• Device order
• Start LBA
• Block size

RAID 1 (Mirror)

RAID 1 creates an exact copy of the drive's data (“mirror”) on another drive or drives. Thus RAID 1 usually consists of mirrored drives which are exact copies of each other. No spanning, striping, or parity is being used. The capacity of the array is limited to the size of the smallest member drive.

If one member drive fails, data is restored by copying from the mirror drive. Because of that RAID 1 can still work even if only one member drive is in good condition.

RAID 1 reads multiple drives in parallel, increasing overall reading performance. But writing speed is lower, as it takes additional time to duplicate data on the mirror drive.

When TaskForce detects a mirrored pair of devices (drives or image files), it labels both of them with the “Mirror” tag.

RAID 1 advantages:

• Improved reading speed.
• High fault tolerance. Data can be restored from the “mirror” drive.
• Simplest RAID storage system.

RAID 1 disadvantages:

• Storage capacity is limited to the size of the smallest member drive.
• Writing speed is lower due to data duplication.

RAID 1 parameters

When reassembling RAID 1 in Atola TaskForce, the following parameters are available for manual selection:

• Device order
• Start LBA

RAID 10 (Stripe of mirrors)

RAID 10 is called “stripe of mirrors” as it combines RAID 1 (“mirroring”) and RAID 0 (“striping”) methods within a single logical array. Data is shared between drives and duplicated. It is a RAID 0 array consisting of mirrors and thus requires a minimum of four drives: two for striping and two for storing mirrored data of each drive.

High read and write performance is achieved by striping RAID 1 mirrored segments.

If one member drive fails, data is restored by copying from the mirror drive. The overall storage capacity is reduced by 1/2 as all data is written twice.

RAID 10 typical use is highly loaded databases, email, or web servers.

When TaskForce detects a mirrored pair of devices (drives or image files), it labels both of them with the “Mirror” tag.

RAID 10 advantages:

• High reading and writing speed.
• High fault tolerance. Data can be restored from the “mirror” drive.

RAID 10 disadvantages:

• Storage capacity is reduced by 1/2 as all data is written twice.
• Limited scalability.

RAID 10 parameters

When reassembling RAID 10 in Atola TaskForce, the following parameters are available for manual selection:

• Device order
• Start LBA
• Block size
• RAID 1 groups

RAID 5 (Distributed parity)

In RAID 5, data in the form of block-level stripes is evenly distributed across at least 3 drives, along with parity information which is used to restore data.

RAID 5 can still operate without one of its members. If one drive fails, its data is calculated from the parity blocks distributed across other members. Atola TaskForce can detect the parameters of the RAID 5 array with two damaged drives and successfully image such RAIDs regardless of errors.

The storage capacity of RAID 5 is reduced due to parity blocks.

Reading and writing speed is high since RAID 5 can read from and write to all array members in parallel.

RAID 5 is typically used for file servers, database servers, and application servers.

RAID 5 can have different layouts, or block orders, depending on the pattern in which RAID 5 data blocks (“stripes”) and parity blocks are distributed among the devices in the array. The layout is defined by:

1. The direction of data blocks writing: left to right or right to left on the disk array.
2. The placement of the parity blocks: at the beginning or end of a stripe.
3. The location of the first block of a stripe relative to the parity of the previous stripe.

There are four RAID 5 layouts (or block orders):

1. Left symmetric.
2. Right symmetric.
3. Left asymmetric.
4. Right asymmetric.

RAID 5 advantages:

• High read speed but slightly lower than RAID 0 because of the overhead from parity calculations and distribution across all disks.
• High fault tolerance. Data from one failed drive can be restored using parity information, stored on other array members.

RAID 5 disadvantages:

• Storage capacity is reduced due to parity blocks. Space efficiency is described by formula: 1 − 1/n, where n is the number of devices in an array. For instance, for RAID 5 consisting of 5 drives with total capacity of 1 TB, available space will be reduced by 1/5 (or 200 MB), to 800 MB.
• Moderate write speed due to the need for parity calculations and writing both data and parity information.

RAID 5 parameters

When reassembling RAID 5 in Atola TaskForce, the following parameters are available for manual selection:

• Device order
• Start LBA
• Block size
• Block order

RAID 6 (Dual parity)

RAID 6 uses block-level striping (data is shared between drives) with two parity blocks, instead of one, distributed across all member disks. This gives extra redundancy to an array: RAID 6 can read and write data even if two drives fail at the same time.

This RAID type needs at least 4 drives to function. Storage capacity is reduced because of the dual parity scheme.

RAID 6 is typically used for large file storage, file servers, database servers, app servers.

Thanks to RAID 6 extra redundancy coming from two parity block types, TaskForce can rebuild a RAID 6 array even if two of its members are missing or damaged.

RAID 6 can have different layouts, or block orders, depending on the pattern in which RAID 6 data blocks (“stripes”) and parity blocks are distributed among the devices in the array. The layout is defined by:

1. The direction of data blocks writing: left to right or right to left on the disk array.
2. The placement of the parity blocks: at the beginning or end of the stripe.
3. Parity block order.
4. The location of the first block of a stripe relative to the parity of the previous stripe.

RAID 6 advantages:

• Very high data fault tolerance.
• Data can be restored even if two drives fail.
• High reading speed similar to RAID 5, but can be slightly slower due to additional parity calculations.

RAID 6 disadvantages:

• Storage capacity is reduced because of the dual parity scheme.
• Reduced writing speed due to the usage of two types of parity blocks.
• Minimum 4 drives needed.

RAID 6 parameters

When reassembling RAID 6 in Atola TaskForce, the following parameters are available for manual selection:

• Device order
• Start LBA
• Block size
• Block order
• Parity block order

RAID read and write speeds

The different RAID levels offer various trade-offs in terms of read and write speed, redundancy, and storage efficiency. Below is a comparison of RAID 0, 1, 10, 5, and 6 regarding their read and write speeds.

Key Points:

• RAID 0 offers the best performance both in reads and writes but no redundancy.
• RAID 1 provides good read performance and redundancy at the cost of available capacity.
• RAID 10 combines the benefits of RAID 0 and RAID 1, offering a good balance of speed and redundancy.
• RAID 5 and RAID 6 offer a good balance between storage efficiency, read speed, and redundancy, with RAID 6 providing higher fault tolerance at the cost of write speed due to additional parity calculations.

Spare

The Spare tag informs you that 99.95% of the drive’s initial 3M sectors are filled with zeros.

A spare (aka hot spare) drive in RAID arrays is used as a standby drive reserved to replace a RAID member in case it fails: in this situation the RAID controller uses redundancy data to reconstruct the data from the failed disk to the spare one. Spare drives are used in RAID 1, RAID 5 and RAID 6.

Mirror

With the Mirror tag, TaskForce informs you that 99.5% out of the analyzed 3M sectors are identical to the same sectors on a different RAID member. It works as a hint that you are dealing with a RAID 1, RAID 10 or RAID 50.

MBR

MBR (Master Boot Record) points to the drive(s) that contain an MBR. Therefore, it is likely that the drive with detected MBR can be placed first in the given array.

File system tags

The initial 3M sectors of each drive/image are analyzed to identify a boot sector of any known file system. When a partition boot sector is detected, the corresponding file system tag is added. To see LBA offset and sector count of the partition, hover mouse cursor over the tag.

Supported file system tags: NTFS, ext4/3/2, APFS, HFS, HFS+, exFAT, FAT32, FAT16, XFS.

Additionally, Unknown tag may appear if the file system identification is not supported yet.

Error

The Error tag informs you whether there are read errors encountered in the process of RAID autodetection. To see the exact number of encountered errors, hover mouse over the Error tag to get the tooltip.

Launch multiple wiping sessions

To perform multiple wiping sessions:

1. Connect the drives to TaskForce.
2. Switch the ports, to which the drives are connected, to Target mode by using the individual Source switches on each port.

3. In the TaskForce user interface, click the Wipe icon on the left.
4. On the Select target device panel, select a drive.
   To launch the wiping process for multiple drives simultaneously, select Multi-launch at the top right, and select the drives you want to wipe.

5. Adjust wiping settings:
   • The range of sectors to be wiped.
   • Wiping method.
   • Enter a pattern and its format (HEX/ASCII).
6. Click Start.

The wiping process consecutively starts for each device. Repeat the same with all the drives you want to wipe.

Track the wiping progress

Once the operations have started, track the progress of all tasks on the Home screen. It displays the percentage of wiped drive area and the time left until the end of the planned session. To see more details on the progress of an individual wiping session, click on that session.

To reveal the current overall speed of wiping, click the Atola logo in the center of the top bar. In this case, we were able to achieve 18 TB/h. This high-speed wiping capability allows a forensic expert to complete the process of preparing drives for wiping in minimal time.

To ensure maximum transparency and effectiveness, TaskForce documents every operation by creating detailed reports and logs. Click Reports at the top and find the report in the list or use the Search bar at the top of the page.

Detect DCO, HPA, or AMA limitations

When you connect a hard drive to the TaskForce unit, in addition to the standard Identify device command, TaskForce software automatically sends two commands to look up the drive size as set in drive’s firmware: Read native max address and Device configuration identify. If drive size has been limited by DCO, HPA, or AMA, TaskForce will draw your attention to these changes by adding the note in red color in the device menu.

Notification about HPA, DCO, and AMA in device menu.

To get more details about the modifications that have been made to the drive’s firmware, run Diagnose and see the Firmware section of the Diagnostics report.

AMA limitation is indicated in the Diagnostics summary.

There you will see three lines indicating the drive’s Max Address according to different records in the drive’s firmware:

1. The Max Address according to device ID line shows the max address from the ID sector, affected by DCO and HPA/AMA restrictions if those are applied.
2. Native Max Address indicates max address ignoring HPA/AMA limitation that may have been enabled, yet affected by DCO restriction.
3. Max Address from DCO is the line that gives you the actual drive size.

A Diagnostics report of a drive that does not have HPA/AMA or DCO activated will have the same value in all three lines.

HPA and DCO restriction details in the Firmware section of the Diagnostics report.

Unclip HPA, DCO, AMA limitations

To disable HPA, DCO, AMA limitations that have been applied to the drive’s firmware:

1. On the left, click Other and then Hidden drive areas.
2. Select device.
3. Click Unclip.

Remove HPA and DCO by clicking the Unclip button.

TaskForce lifts HPA/AMA and DCO restrictions in a matter of seconds and enables access to all data on the drive.

HPA and DCO unclip report.

Unclip HPA temporarily (until power cycle)

To ensure the forensically sound process, it can be necessary to avoid making any changes to the drive. Therefore it is prohibited to disable HPA and DCO restrictions and access data in the hidden areas. With TaskForce it is possible to lift HPA restriction until the next power cycle. This helps avoid permanent changes to the drive.

To unclip HPA on the source drive until power cycle before imaging:

1. Go to Image.
2. Select source device.
3. Select target devices and click Continue.
4. In Confirmation dialog, suggesting you unclip the drive until power cycle, click Yes.

This will allow temporary access to the data in HPA-protected area, but as soon as you power off or unplug the drive, the HPA will be back again.

After you confirm unclipping HPA until power cycle, the imaging process starts and the following message appears in the imaging log: Source device HPA was set to native max address until power cycle.

The message in the imaging log informs that source device HPA was set to native max address until power cycle.

Set or change HPA, DCO, AMA limitations

Not all drives support hidden areas. Limitation type supported by the particular drive will be shown in green on the Hidden drive areas page.

The drive supports DCO and HPA limitations, but does not support AMA.

The DCO and HPA can co-exist on the same drive: max address limited via HPA should be less than DCO.

Expectedly, AMA is supported by new drives and can't exist if DCO or HPA is supported, and vice versa.

If your target device is larger than your source device, but you need hash values for the source and for the target devices to be identical, see Clip target drive to source evidence size.

To set or change DCO limitation:

1. Make sure that the drive is in the Target mode.
2. On the left, click Other and then Hidden drive areas.
3. Select device.
4. Enter new Native max address. Notice that ID sector max address changes accordingly.
5. Click Change.

Setting new DCO limitation.

To set or change HPA limitation:

1. Make sure that the drive is in the Target mode.
2. On the left, click Other and then Hidden drive areas.
3. Select device.
4. Enter new ID sector max address.
5. Optional: Check Change ID sector max address temporarily (until power cycle) if needed.
6. Click Change.

Setting new HPA limitation.

To set or change AMA limitation:

1. Make sure that the drive is in the Target mode.
2. On the left, click Other and then Hidden drive areas.
3. Select device.
4. Enter new ID sector max address.
5. Click Change.

Setting new AMA limitation.

View the previously calculated hash

To view the previously calculated hash calculated for an E01 file with Atola TaskForce, open the imaging report in the case management system. It contains the hash values calculated during imaging.

Alternatively, you can look up the metadata stored in the E01 file itself:

1. At the top, click Devices.
2. Expand the File category and click Select file.
3. Select the E01 file in the file browser.

Hash calculated during imaging stored in E01 file's metadata

Recalculate the hash for an E01 file

To ensure the integrity of the data in the file, you can recalculate its hash.

1. On the left taskbar, click Other, and then Hash.
2. To choose the file for which you want to calculate hash, expand the File category and click Select file.
3. Select the E01 file in the file browser.
4. Adjust hashing settings. Make sure to select the same hashing types (MD5, SHA1, etc.)
5. Click Start.

Start hash calculation

When the hash calculation is completed, you can make sure that the two sets of hashes are identical.

Compare the calculated hash values to the ones calculated during imaging

Segmented hashing vs regular hashing

With conventional hashing method you get a single hash for the entire image, while segmented hashing allows getting many hashes of corresponding LBA ranges of the image. The sum LBA ranges represents the entire image.

Verifying all hashes in a set allows you to prove that the entire image has not been modified.

Segmented hashing and post-hashing of the target for immediate image verification

1. Go to the imaging Settings.
2. On the Hashes tab, select Segmented hashing method.
3. To obtain both sets of hashes for the evidence drive and the image, toggle Post-hash target devices.

Selecting hashing method.

Hashing while imaging does not slow down the imaging session:

TaskForce imaging session.

Post-hashing will commence as soon as the imaging session is completed:

Atola TaskForce: Post-hashing.

In the Imaging completed report you can see imaging results with the link to the file with segmented hashes.

In case you select the post-hashing of the target, you also get the results of cross-checking between the hash sets of the evidence drive and the image.

Atola forensic imager: Imaging results

Benefits of segmented hashing

With the conventional linear hashing method you get a single hash for the entire image. As the linear hashing stops upon encountering the first bad sector, it is impossible to calculate hash for the entire space of the source evidence drive.

With segmented hashing, hashing can be performed during the multipass imaging of a damaged drive. Hashes are calculated only for the successfully imaged areas, while all bad sectors are excluded from the calculation.

If an acquired evidence image is damaged at some point in the future, with the regular linear hashes you will get a hash mismatch upon verification, and the entire image becomes useless. With segmented hashes only the hash of the damaged segment will become invalid.

Calculate segmented hashes of a source and target devices

To calculate segmented hashes of a damaged drive during imaging and post-hash the target for immediate image verification, do the following:

1. Go to the imaging Settings.
2. On the Hashes tab, select Segmented hashing method and specify Segment size.
3. To obtain both sets of hashes for the evidence drive and the image, toggle Post-hash target devices.

Selecting hashing method.

Hashing while imaging does not slow down the imaging session:

TaskForce imaging session.

Post-hashing commences as soon as the imaging session is completed:

Atola TaskForce: Post-hashing.

In the Imaging completed report, you can see imaging results with the link to the file with segmented hashes.

In case you select the post-hashing of the target, you also get the results of cross-checking between the hash sets of the evidence drive and the image.

Atola TaskForce: Imaging results.

Verify an image of a drive with segmented hashing

To verify an acquired image file of an evidence drive with segmented hashing, do the following:

1. In the TaskForce window, go to Other > Verify segmented hashes.


The Verify segmented hashed command on the Other page.

2. The Select device panel opens. Expand the File section and click Select file.


The Select device panel.

3. Select an image file you want to verify. The E01, AFF4 and Raw formats are supported.


Selecting an image file to verify segmented hashes.

4. Select the CSV file with segmented hashes that relates to your image file:
   1. Choose either Local folder or Network folder or Storage.
   2. Click Select.
   3. Find and select a CSV file with segmented hashes.
5. Click Start.


Selecting a CSV file with a list of segmented hashes.

6. TaskForce starts the data verification process.


The process of verifying segmented hashes.

7. If TaskForce encounters a hash value mismatch, it is reflected in the Hash mismatches counter and in the event log, with Start and End LBA of the respective segment.


Hashes of one of the segments do not match.

8. Once verification of segmented hashes is completed, TaskForce generates a detailed report about its results. The report contains information about the verified image and the file with its segmented hashes, hash type, number of processed hashes and found mismatches if any.


The report about completed verification of segmented hashes.

Report types and formats

There are two types of reports in TaskForce:

1. Device reports are created every time an action is taken to the drive: drive identification, imaging, hashing, wiping and other operations related to the drive are documented in these reports.
2. Non-device reports are created to register any changes made to the cases: case opening, case details change, case import and export.

All reports have these key elements: a header that provides device and case details, an action summary and task details (task settings, task log, etc.).

Imaging report in Atola TaskForce.

A diagnostics report contains even more details: it lists the checkup results for all subsystems of a drive and includes oscillograms, SMART table, etc.

Diagnostics report in Atola TaskForce.

Add a case from the Devices menu

1. Connect a device to TaskForce.
2. In the TaskForce main window, click Devices.
3. In the Select device panel, in the port with your device, click More icon, and then select Add case.

Adding a device to a new case from the Devices menu.

4. Enter case details and click Continue. TaskForce creates a new case and adds your device to it. The Case created report appears on the Home screen and on the Reports page.

The Case created report on the Home screen.

Case created report details.

Add a case from the Cases page

1. Connect a device to TaskForce.
2. In the TaskForce main window, click Cases.
3. On the Cases page, click Add case.
4. In the Select device panel, click on your device.
5. Enter case details and click Continue. TaskForce creates a new case and adds your device to it. The Case created report appears on the Home screen and on the Reports page.

The Enter case details dialog.

Add a case from the Device page

1. Connect a device to TaskForce.
2. In the TaskForce main window, click Devices.
3. In the Select device panel, click on the port with your device. TaskForce takes you to the Device page.
4. Optional: If TaskForce hasn’t identified your device yet, then, on the Device page, click Re-identify.
5. In Case ID pane, open the drop-down menu, and then click New.

Change active case menu is opened on the Device page.

6. Enter case details and click Continue. TaskForce creates a new case and adds your device to it. The Case created report appears on the Home screen and on the Reports page.

Enter case details before starting any task

Entering case details before performing any operation with a device helps you to keep your cases organized and searchable. TaskForce can be set to request that you enter case details before starting any task.

To enable this feature, do the following:

1. In the TaskForce main window, go to the Menu > Settings.
2. In the Cases section, toggle Set case details before task start.

Now, TaskForce will ask you to enter case details before performing any operation with a device.

The Set case details before task start toggle on the Settings page.

Atola TaskForce asks a user to enter case details before starting diagnostics.

Set default values for all cases

If Investigator, Organization, or Location are the same for all or majority of your cases, set them as default for all new cases, and TaskForce will fill those fields automatically every time you create a new case:

1. At the top right, go to Menu > Settings.
2. On the Settings page, scroll down to the Cases section.
3. Toggle on Set default values for all cases.

The 'Set default values for all cases' toggle on the Settings page.

4. Next to the toggle, click Change.
5. Fill in the default values for Investigator, Organization, or Location and click Save.

The 'Set default values' dialog.

Show 'Add case' button

You can add cases right from the TaskForce Home screen before working with the device. To do that, set TaskForce to show Add case button in the top panel:

1. In the TaskForce main window, go to the Menu > Settings.
2. In the Cases section, toggle Show 'Add case' button on TaskForce top panel.

Now, TaskForce shows the Add case button in the top panel.

The toggle in the Cases section on the Settings page.

The Add case button in the Atola TaskForce main window.

Add a device to another new case

To add your device to several new cases, do the following:

1. Connect a device to TaskForce and identify it.
2. Add first new case and include your device to it. For guidance, see Add a case.

After you have added your device to the first case, do the following steps:

3. In the TaskForce user interface, click Devices.
4. In the Select device window, click on the port with your device. TaskForce takes you to the Device page.
5. In Case ID pane, open the drop-down menu, and then click New.

The New button in the Change active case menu on the Device page.

6. Enter case details and click Continue.

TaskForce creates another new case and adds your device to it. The Case created report appears on the Home screen and on the Reports page.

Add a device to another existing case

When you already added your device to one case and want to add that device to another existing case, do the following:

1. Connect a device to TaskForce.
2. In the TaskForce user interface, click Devices.
3. In the Select device window, click on the port with your device. TaskForce takes you to the Device page.
4. Optional: If TaskForce hasn’t identified your device yet, then, on the Device page, click Re-identify.
5. In Case ID pane, open the drop-down menu, and then click Select.

The Select button in the Change active case drop-down menu on the Device page.

6. In the Select active case window, chose your existing case. If needed, use the Search field to find it. TaskForce adds your device to the selected case.

List of all your cases in the Select active case window.

Switch between cases on the Device page

When a device is added to more than one case, TaskForce keeps reports, which are associated with each case, separate.

To switch between cases on the Device page:

1. In Case ID pane, open the drop-down menu.
2. Click on the case you want to make active. TaskForce shows reports, associated with selected case.

List of all cases associated with the device in the Case ID pane.

Edit case details

To change case details, click Edit at the top of a case page.

Case page

It is possible to change the case ID, Description and Investigator. Click Save when done editing.

Changing case details.

1. Via case page

All reports related to the case are listed at the bottom of the case page. Scroll down and turn pages to view all the reports, sort them by date or by title, use the search bar to look for specific reports by their titles.

To open a report, click the respective line.

Case page with reports.

2. Via Reports page

If you need to search among all existing reports, click Reports at the top.

The Reports button.

This will redirect you to the page with all existing report that can be filtered by date, title, case ID or device details. Search for a specific report by entering report title or drive details.

Open the report you need by clicking it in the list.

The Reports page.

3. Via Home screen

Similarly, recent reports can also be found on the Home screen underneath the Active tasks.

On the Home screen you can look up active and completed tasks and view reports for all completed tasks.

Quickly find specific reports by entering filters in the search field.

Finding reports on the Home screen.

Imaging

RAID configuration autodetection & imaging

Performance

Connectivity and environment setup

Tablet screen

Wiping

Case management & reports

Hardware

Subscription and firmware update