With newest Atola TaskForce 2020.1 firmware, it is possible to image into files on an encrypted target drive using VeraCrypt for data encryption. Multiple target drives can be encrypted for the same or different sessions.
After you have connected the source drive to a port in Source mode, take these steps:
1. Click on Image icon in the left-side taskbar
2. In Select source device panel, select the evidence drive
3. In Select target device menu, click on the tile in the File section
4. In Select image file window, click Add storage Click the link Create Image File on Target.
5. In Select device panel, choose the drive connected to a port in Target mode
6. Select Create an encrypted VeraCrypt container (exFAT) option and click Next
7. Enter and confirm the password for the encrypted volume on the drive
8. Confirm the formatting of the device by entering YES and clicking OK. After this step, the formatting will take a few seconds.
9. Click + Create file button
10. Enter the name of the image and choose the file format (E01, raw, img or dd).
11. Once you have created the file, you may add more image files in the same or a different folder
After you click the Continue button, TaskForce will image the evidence into the file on your encrypted target.
Upon completion of the imaging session, check the Imaging completed report.
Data Extraction
- To find the VeraCrypt volume and the imaged file, plug the target drive into your computer;
- Use VeraCrypt software to safely access encrypted data from your drive;
- Select the drive label (A, B, C, etc.) on which you want the volume to be mounted;
- Click Select device button;
- In the pop-up window select your encrypted volume;
- Click the Mount button.
Now you can view the partition name, size and encryption algorithm.
7. Next, use the password set prior to the imaging session to get access to the encrypted volume.
Once you have entered the password, the volume will be mounted and you can access it from Windows Explorer and use the image for subsequent operations.
Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.
- Top digital forensic conferences in 2024 - January 1, 2024
- 2023. Year in Review - December 31, 2023
- Top digital forensics conferences in 2023 - January 1, 2023
Yulia Samoteykina
Director of Marketing Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.
