TaskForce’s complex imaging functionality allows imaging even physically damaged drives, while avoiding further drive deterioration. Damaged media require a sophisticated imaging approach to balance out thorough data extraction with forensics’ need in expediency and careful treatment of damaged media.
Most forensic imagers can only do linear imaging, which dramatically slows down imaging process whenever a bad sector is encountered, and, as a result, the drive may freeze. To speed up imaging of damaged media and maximize the amount of successfully retrieved data, TaskForce has a special imaging algorithm that includes deliberate timeout and block size control.
Using small block size pays off when you need to thoroughly retrieve maximum data from an unstable drive, but it also significantly slows down the imaging process. What’s worse, such imaging approach may cause further damage to the media. That’s why TaskForce’s multi-pass imaging engine uses large blocks with short timeouts on the first few passes, scheduling reads inside slow areas for later and then using the smallest block size on the last pass when very few sectors are left to be read.
This technique allows the bad areas to be approached in the most gentle way, while achieving imaging speeds of up to 550 MB/sec in good areas of the drive and reaching an unbeatable overall speed of imaging.
TaskForce handles block size automatically, to provide the best possible results in the shortest time span. This makes TaskForce faster at virtually any job than any other data recovery or image acquisition tools commercially available.
Block sizes and timeouts are adjustable. However, the default settings of the passes are based on our decades-long experience in data recovery market to fit most types of damage to the drives. That’s why we suggest that you use the default settings unless a particular drive requires a specific imaging approach.
On the first pass, TaskForce allows 1-second Timeout per block, and the Max read block size is set to 4096 sectors. This allows smooth sequential imaging of all healthy modern drives. But when imaging damaged media, these settings allow TaskForce to skip any areas that slow down the process and perform Jump on error by 1,000,000 sectors at a time. This way all the good areas of the drive are imaged at top speed, while forcing TaskForce to return to the problematic areas on the next passes, narrowing down the bad areas and allowing more time to retrieve the data within them.
While Max read block size remains the same during the second and the third passes, the Jump on error is set to 20000 sectors and 4096 sectors respectively and slightly longer, 5-second Timeouts are allowed for attempted reading of the blocks.
On the fourth pass, both Jump on error and Max read block size are reduced to 256 sectors.
On the fifth pass, TaskForce allocates 60-second Timeouts to read the Maximum block size of 256 with just 1-sector Jump on error. It is the last and the most thorough attempt to retrieve data from the remaining bad areas of the drive.
After the final pass, the Imaging Results report will indicate the eventual number of errors on the drive and other detailed statistics.
By clicking on one of the imaging passes in the imaging settings, you can adjust all parameters of the pass. Reverse direction option may help handle some of the damaged media. With this function selected, TaskForce will approach skipped areas of the drive from the opposite side on any selected pass. This way TaskForce can get more data from a drive before entering a damaged zone, which needs to be concentrated on during the following passes.
Another option in the imaging pass settings, which is worth mentioning is Disable read look-ahead. Most contemporary hard drives have read look-ahead functionality, which makes the drive sequentially read more blocks than requested in a command. In good drives, this functionality helps the drive to operate faster by reading more data and caching them. But with bad drives, read look-ahead leads to bad areas being addressed more often, which slows down the process and may lead to a complete freeze of the drive. In such cases, disabling read look-ahead option is advisable.
Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.
- Top digital forensic conferences in 2024 - January 1, 2024
- 2023. Year in Review - December 31, 2023
- Top digital forensics conferences in 2023 - January 1, 2023
Yulia Samoteykina
Director of Marketing Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.
