Hurray! Atola has released the newest firmware for TaskForce introducing Logical Imaging as the update’s key feature. The 2022.4 firmware also includes these major enhancements:
- improvements to the RAID autodetection module
- NVMe drive diagnostics
- 50% increase in the speed of SHA hash calculation
- in-depth FAT32/16 filesystem support
- new Date/Time, ‘Add case’ button, printing settings
Logical imaging
Atola TaskForce customers have been asking about it a lot. Here are just a few requests:
“We would want to be able to verify with the client the number of successful files recovered, preferably by extension (.JPG, PDF, DOC, ETC).”
“I need to image XFS files because Windows doesn’t see XFS partitions.”
“Our first step is selecting and imaging all document files, including those stored in Zips.”
“Our unit has a scenario and was wondering if it would be possible to implement for the TaskForce? We have two active investigations (homicide and child pornography) that resulted in large seizures (approx. 75+ devices for each case). I was wondering if it’s possible to build in a file explorer into the TaskForce software? We are looking at triaging the devices and if files have not been accessed within the past two years they will be omitted from the analysis.”
Here is our answer! Meet the Logical icon in the left sidebar. It is a new core function of the product.
TaskForce allows launching 12 and more simultaneous logical imaging sessions. It turns TaskForce into the most effective triage and logical data acquisition system ever.
When you think how much time you can save by imaging only the required data as opposed to a whole drive, this new functionality makes the system even more effective. The smart include/exclude filters simplify and speed up the process of the files/folders subset selection.
The logical imaging module supports all types of evidence sources accessible by TaskForce:
- SATA, SAS, NVMe, USB, IDE drives
- assembled RAID arrays
- Macbook drives
- Raw/E01/AFF4 image files located on a network or a storage drive plugged into TaskForce
2022.4 firmware update enables selecting L01 image file as a destination. L01 compression is already built-in.
What if there are too many files to copy and you can’t finish the job now?
We designed the Pause/Resume feature in line with how it works in the physical imaging engine. So it is easy to:
- Pause logical data acquisition
- Turn off the TaskForce
- Power it on later
- Resume the logical imaging session exactly from the very “pause” moment
or
- Pause logical data acquisition
- Export the case
- Transfer the source drive and the exported case to a different location that has another TaskForce
- Import the case
- Resume the logical imaging session
NVMe diagnostics, RAID, new system settings, etc.
Let’s briefly look at other significant features arriving with the 2022.4 firmware update.
NVMe diagnostics
The diagnostic module has been enhanced with a testing controller checking firmware and data of NVMe drives. Reading and analyzing the NVMe SMART table is available within the Imaging and View SMART features.
Check out a sample of the PDF report: NVMe drive diagnostics
Better RAID autodetection
There is now an additional RAID autodetection stage 3. The 3rd stage is only launched when stage 2 fails to detect RAID configuration. Stage 3 introduces an alternative heuristic approach of identifying a suitable configuration. The partition preview indicates the percentage of valid files resulting from each detected RAID configuration.
Case settings
For a more obvious way of creating new cases, you can activate the ‘Add case’ button to appear in the top panel.
Where is my Hash button?
No worries. Since Logical icon was added to the sidebar, we moved Hash button to Other feature group.
Changelog
New Features
Logical imaging feature-set:
- 12+ parallel logical imaging sessions
- Ability to pause and continue each session
- L01 target images stored in the network or a destination drive
- Advanced logical image acquisition using include/exclude filters
- Supported file systems: NTFS, ext4/3/2, exFAT, XFS, HFS, HFS+, HFSX, FAT32/16
Imaging:
- SHA hash calculation performance increased by 50%, reaching 1GB/s speed now
- SHA-256 and SHA-512 calculation when imaging to E01 file. Hashes are stored in the imaging report only.
- New Web API call: /report – downloads ZIP-file with imaging report, log and additional CSV files if segmented hashes and file signatures enabled
- Reading NVMe source drive SMART attributes before and after imaging
RAID:
- New stage 3 of RAID configuration detection (extended) added
- Better autodetection of RAID array with non-zero Start LBA
- Improved NTFS automatic validation
- Added explanatory tooltips for RAID tags: Spare, MBR
Diagnostics:
- NVMe drives supported
- Click on the ‘Diagnose’ button powers up and identifies drives by default
- File system check. Partition labels are displayed now
New system settings:
- Show ‘Add case’ button on TaskForce top panel
- Set date and time automatically or manually
- Print settings moved to settings instead of popping up in a dialog after every Print action
An improved user experience when printing multiple reports.
File manager. New ‘Create folder’ button.
Other -> View SMART. NVMe drive support.
System log improved to provide better TaskForce diagnostics and tech support.
Bugfixes
Some SSD models could not be identified on SATA ports after power cycling TaskForce
It was impossible to parse an NTFS partition created on an external drive by Xbox One S
NTFS parsing error for partitions with cluster size > 128KB
Incorrect capacity detection of WD MyBook 4TB USB drives
A missing detection hint after RAID auto assembly restart for an array created with mdadm
IP display could have an IP address missing in rare cases
Device page. Showing invalid Modified Dates of target image files on a Storage drive
A lengthy Case Description could cause reports to look buggy
Download
You can download the latest update here: TaskForce firmware
Where to buy
If you still do not have an Atola TaskForce and would like to place an order, this can be done directly via Atola Technology, or from a distributor near you:
Please contact Atola Technology sales department to receive more specific information:
- Call us: +1 888 540-2010, +1 416 833-3501 10am – 6pm ET
- Or email us
P.S. Dear customers, we appreciate your feedback and take it into consideration when updating our products, feel free to write your thoughts and ideas in the comments section below.
He believes in saving time & energy of people doing mission-critical work. Therefore, all his efforts are focused on leading R&D of innovative Atola products.
Gamification enthusiast. Agile development proponent.
- Atola TaskForce 2023.4.2 stability update - August 7, 2023
- Wipe multiple drives in Atola Insight Forensic 5.2 - May 26, 2022
- Logical imaging in TaskForce 2022.4 - April 11, 2022
Vitaliy Mokosiy
Atola CTO He believes in saving time & energy of people doing mission-critical work. Therefore, all his efforts are focused on leading R&D of innovative Atola products. Gamification enthusiast. Agile development proponent.
