Atola Blog

Atola TaskForce

AFF4 support in Atola TaskForce 2021.4

Atola is pleased to announce the support of AFF4 files in Atola TaskForce, which makes it the second hardware imager able to create AFF4 files after Atola Insight Forensic! Imaging to AFF4 AFF4 is a highly optimized open-source forensic file format with a wide range of benefits: Open-source format: you can describe it in a court Supports multi-pass imaging Fast compression methods: Snappy and LZ4 Block hashes Stores binary zeroes as spans similar to sparse files Vendor-neutral AFF4’s block hashes are calculated for small segments of data on the drive and are stored in a table inside AFF4 metadata and there is a Block map hash that represents a single Read more…

By Yulia Samoteykina, ago
Atola TaskForce

RAID configuration detection in Atola TaskForce

With RAIDs landing on forensic examiners’ desks often being completely anonymous, finding the correct RAID configuration becomes a tedious manual job that can take hours and days to complete.  To make this process efficient and effortless, Atola developers equipped TaskForce forensic imager with a breakthrough configuration autodetection module. This time-saving solution automates the configuration search and allows the operator to focus on the more urgent tasks that require human attention. TaskForce Autodetection module TaskForce’s RAID configuration autodetection process commences immediately upon selection of the RAID members, which can be any combination of devices and image files.  In Stage 1,  the autodetection module reads data on the drives to determine the Read more…

By Olga Milishenko, ago
Atola TaskForce

Imaging RAID 5 with a missing device

When it comes to RAID imaging, a forensic specialist may be confronted with an array that not only has an unknown configuration but also one of the drives severely damaged or missing. This is when Atola TaskForce comes to the rescue! If this is a RAID 5 with a missing device, TaskForce uses the array’s redundancy to create a full image of the RAID. All you need to do is select all available RAID members and click the Add missing device button. Auto detection module will recommence when a new image file or device is added. TaskForce can identify the right configuration and reassemble the RAID, using redundancy. When a Read more…

By Olga Milishenko, ago
Atola TaskForce

Imaging RAID 5 array with errors on multiple drives

When imaging RAID 5 array with errors on multiple drives, Atola TaskForce is still able to detect its parameters and image the whole RAID. Let’s examine a case with a RAID 5 consisting of 5 drives, two of which have bad sectors. Reassembling RAID 5 array with errors on multiple drives Click the RAID button in the left-side taskbar and select the drives that make up the RAID array.  TaskForce autodetection module starts running immediately upon selection of the RAID members. In Stage 1, TaskForce reads data on the drives to identify the RAID type. In case it runs across an error, it displays an Error tag next to the corresponding RAID Read more…

By Olga Milishenko, ago
Atola Insight Forensic

Atola Insight 4.17 with AFF4 support

Our dev team has decided to celebrate 2021 with a new software update. With this release, Atola Insight Forensic has become the first forensic hardware imager in the world that is able to image into AFF4 files! Here is why AFF4 support is so important. AFF4 imager So what’s the big deal about AFF4? This file format has several upsides: Open-source format: you can describe it in a court Fast compression methods: Snappy and LZ4 Block hashes It stores binary zeroes as spans (in a “sparse file” manner) Vendor-neutral Since our team is always focused on performance and AFF4 is a highly optimized file format, Insight’s imaging speed will be Read more…

By Vitaliy Mokosiy, ago
Atola TaskForce

The importance of ECC RAM in forensic imagers

When working with evidence drives, data integrity is critical. Using ECC RAM, which identifies and corrects common single-bit errors, would help dramatically improve data transfer reliability in digital forensic tools. Why use ECC memory Electrical, magnetic or even radioactive interference inside a system, may cause a single bit of DRAM (Dynamic Random-Access Memory) to flip to the opposite state, resulting in an error. While the single-bit error in an ordinary situation could be harmless or have a comparatively mild effect (like a wrongly colored pixel in a .jpeg file), in forensic imaging, it means that the whole image you get is compromised. Because the hash of the image won’t be Read more…

By Olga Milishenko, ago