12+ simultaneous forensic imaging sessions

Forensic hardware imager.

Thanks to its 18 ports and high-performance server-grade hardware, Atola TaskForce runs more than 12 forensic imaging sessions simultaneously at the cumulative imaging speed of 15 TB/hour, creating bit-by-bit copies on target drives or image files on a server or a storage device.

Highly customizable imaging settings make it possible to use Atola TaskForce forensic hardware imager in a vast variety of forensic cases, including those involving automated data recovery from damaged drives.

Visual real-time representation of imaging status with detailed statistics, HEX viewer, and file signature detection help a forensic examiner evaluate preliminary evidence during imaging.

Logical imaging to L01 serves as an alternative to physical imaging and is also easily parallelized.

Run 12+ parallel sessions at 15 TB/hour cumulative speed

Forensic imaging of 12 drives in parallel

Forensic imaging of 12 drives in parallel

Why is Atola TaskForce forensic hardware imager so fast?

Because it is assembled from extremely robust, high-capacity components. They include a server-class motherboard, 8-thread Xeon CPU 3.7 GHz, and ECC RAM. Another reason is its unique and heavily optimized software to run multiple tasks in parallel.

This lets our imager to achieve 15 TB/hour cumulative imaging speed when running 12 or more parallel imaging sessions.

TaskForce is equipped with two 10Gb Ethernet ports, thus enabling high data transfer rates when imaging to a network server.

Plug various drive types to 18 ports in source or target mode

Forensic hardware imager with 18 ports.

All 18 ports of TaskForce forensic hardware imager can be used as either a source or a target thanks to the Source switch. In the Source mode, hardware write protection is enabled.

The ports include:

  • 6 SATA
  • 6 SATA/SAS
  • 4 USB
  • IDE
  • Extension slot (for Atola Thunderbolt, Apple PCIe SSD and M.2 NVMe/PCIe/SATA SSD extension modules)

Image to a target device or a file

Source evidence drives can be imaged to up to 5 targets each. Targets may include:

  • Other drives: SATA, SAS, USB, NVMe, IDE
  • E01, AFF4, RAW files located on a network server
  • E01, AFF4, RAW files located on drives connected to TaskForce. Encryption with VeraCrypt is available as an option.

When imaging encrypted or compressed (archives, videos, pictures ) data to E01 compressed file, the built-in rapid adaptive compression algorithm saves a great deal of time and reduces TaskForce's CPU load. It performs on-the-fly data analysis and dynamically disables compression on uncompressible data chunks.

Target file templates are helpful to easily set up the naming convention for your image files, their folder paths, and metadata according to your organization's rules.

Start imaging automatically in Express mode

17 imaging sessions in progress.

17 imaging sessions in progress.

Atola TaskForce forensic hardware imager empowers your team to streamline and expedite your workflow with Express mode.

Once the Express mode is enabled, you just plug your evidence drive into any of TaskForce's ports, and an imaging session starts automatically with the settings of your choice.

In the Express mode, TaskForce can process up to 17 parallel imaging sessions.

Pause now, resume later

Yes, you can pause an imaging session at any time and then resume it when needed, after a minute, a day, or a week.

All imaging settings for this session will be saved. The imaging map logs all imaged sectors, so when you click the Resume button, the acquisition will continue right from where it stopped, seamlessly completing the image with outstanding data.

Image even bad drives with maximum care

Atola TaskForce forensic hardware imager handles damaged drives in the most gentle and thorough way by applying a wide range of data recovery features:

  • multipass imaging with different timeouts for each pass
  • automated handling of freezing damaged drives
  • imaging data from good heads only
  • imaging in the reverse direction
  • disable read look-ahead mode
  • simultaneous hash calculation
  • calculation of segmented hashes
  • read block size management
  • tracking changes in drive's health using its SMART table
  • programmable behavior and even more fine-tuning for the toughest cases
  • short circuit protection
  • an automatically generated detailed report with unread sectors

Tailor imaging settings to your current case

Atola TaskForce forensic hardware imager lets you fine-tune the acquisition process according to the peculiarities of your current case.

For typical cases, you can save your settings as a preset, activate it with one click, and even share it with colleagues who use another TaskForce via a simple export/import.

TaskForce comes with two pre-configured presets: Default and Damaged, recommended for good and faulty drives respectively.

The Damaged preset for imaging faulty drives.

The Damaged preset for imaging faulty drives.

Here are the customizable imaging settings.

Choose where to image

Using drives, RAIDs, or files as a source, Atola TaskForce supports sector-by-sector imaging:

  • To a target drive, connected directly to TaskForce
    • SATA
    • SAS
    • USB
    • NVMe
    • IDE
  • To a file on a network server
  • To a file on a target drive

Supported image file formats are:

To know more about various types of image acquisition supported by TaskForce, see Sources and Targets.

Choose what to image

  • All sectors of evidence drive
  • Only sectors with data
  • Custom sector range
  • Only selected partitions
  • Only selected file types
  • Only files with selected attributes

Choose to handle a drive as good or damaged

If the built-in diagnostics module shows that a drive is in good condition, apply the default preset with one pass and linear hashing.

If the diagnostics report shows that a drive has issues, play it safe and use our elaborate multipass imaging engine to protect the media from further deterioration. The hashing method will be switched to segmented to ensure that all acquired data is forensically sound.

You can also modify:

  • Number of passes
  • Timeouts for each pass
  • Max read block size for each pass
  • Number of sectors to skip after a failed read attempt

If a drive has one or several damaged heads, you can choose to disable them from imaging.

Choose how to hash

In terms of hashing, you can choose from the following options.

Hashing method:

  • Linear, more suitable for good drives
  • Segmented, more suitable for damaged drives

How to calculate hash:

  • Pre-hash source device
  • Hash source during imaging
  • Post-hash target devices

What type of hashes to calculate:

  • MD5
  • SHA-1
  • SHA-256
  • SHA-512

Make preliminary evidence evaluation during imaging

Atola TaskForce provides a wide set of tools to control the imaging process and evaluate drive content on the fly while it is still being imaged.

Control all aspects of the imaging process

The imaging status screen shows all necessary information in real time.

The visual feedback includes:

  • Hard drive's drive space map, showing good and bad areas
  • Statistics (speed, good/bad sectors stats, ETA)
  • By-head read speed graph (allows early detection of a failing head)
  • HEX Viewer with automated sector analysis
  • Log view

You can perform these actions during imaging:

  • Pause the process (imaging can be seamlessly resumed later at any time).
  • Add new imaging passes to the imaging session to attempt re-reading the bad sectors.
  • Jump to any sector on the drive by pointing and clicking with cursor on any location in the imaging map.

Once the imaging is over, all status information is automatically sent to the Case Management module.

The imaging report contains all necessary information, including the source drive’s SMART table before and after the imaging process.

View HEX values of the drive’s content

The real-time data viewer shows the raw data extracted from the source drive during imaging. There are two modes available:

  • Automatic with refresh and a Freeze button
  • Manual with a Read sector button

Automated sector analysis checks each sector for file system structures (NTFS File Record, boot sectors, etc.)

Automatically detect file signatures

The imager performs file signature analysis during imaging. It shows live stats of all detected signatures while the data is being acquired, with no negative impact on the imaging performance. Moreover, you can easily check raw sector data for any found file using the HEX Viewer without even pausing the imaging process.

See this small animation:

The imager performs file signature analysis during imaging.


HINT: If there are no signatures found during imaging, we recommend clicking HEX viewer to check what kind of sector data is being imaged.

  • If sectors contain random data, then it is most likely an encrypted partition.
  • If sectors contain zeros, the drive has likely been wiped. It makes sense to put it off and acquire other devices instead.

Get a detailed report after imaging

TaskForce case management system records every step of the data acquisition process: every operation is automatically added to the case from the moment a device is identified, including date, time, imaging map and hash values.

When a hard drive is imaged, its imaging map is recorded, detailing all the sectors that have been skipped.

Whenever an operator connects a hard drive to TaskForce, the system makes an automatic database lookup and retrieves all the previous records associated with that particular hard drive.

New entries are added seamlessly to the database. You do not need to enable case management or take any additional actions for it to start functioning; it is fully embedded into Atola TaskForce and works at all times.

You can print a report or save it as a file to pass to a colleague.

The Imaging completed report in Atola TaskForce.

The Imaging completed report in Atola TaskForce.