Restore E01, AFF4, RAW image file to drive

To restore data from an image file to a drive using Atola TaskForce, follow these steps:

1. In the TaskForce main window, click Image.


2. On the Select source device panel, expand the File section and then click Select file.


3. Select the E01, AFF4 or RAW file you are planning to restore.


4. Select the target drive and click Continue.
   

   If your target drive is larger than the size of the image, the hash values of the target drive will not be identical to that of the image file. With TaskForce, you can limit a SATA target drive's capacity via Host Protected Area (HPA) or Accessible Max Address (AMA). Applying the HPA or AMA will set a new max address in the drive’s firmware, which will make the sectors beyond the required capacity inaccessible. This will make the hashing process straightforward and the hashes will match.

   To limit SATA target drive's capacity via HPA or AMA, go to the imaging Settings and click the Change button.

   

   Go to the Miscellaneous tab and enable the Limit target disk size to source size using HPA/AMA option.

   

5. Click Start for the imaging to begin.

TaskForce automatically creates detailed reports for every session. The imaging report lists all the details of the source, the target, the imaging settings and timestamps including the setting of the new max address of the target drive. This makes such data extraction from a file transparent and forensically sound.