It’s already here! Atola has released new features for TaskForce with its new firmware version 2022.10. Now users of Atola TaskForce can:
- Unlock and image drives with APFS volumes.
- Reassemble RAID automatically, even with one missing drive.
- Securely wipe NVMe drives.
- Create and manage several user profiles for one TaskForce unit.
Let’s dive deeper into each of these great features!
Unlock and image drives with APFS volumes
Yes, now you can use TaskForce to acquire data from devices or images with APFS file system. It is one of the newest file systems created by Apple for its devices, including Mac, MacBook, iPad, iPhone, Apple TV, and Apple Watch.
Connect a source device or mount a forensic image file with APFS volumes, unlock volumes with a known password or recovery key, and create a logical image of the files and folders you need. Use the folder and file filters to narrow down your selection and to save your time and disk space on the target.
TaskForce also lets you image the whole device with APFS volumes, either to a target hard drive or to a forensic image file.
And, of course, RAID module in TaskForce now supports physical and logical imaging of arrays with unencrypted APFS volumes.
Reassemble RAID automatically, even with one missing drive
RAID 5 is one of the most popular RAID types. But what if you don’t know the right order of the RAID disks and one of the RAID members is lost or damaged. How to acquire data in that case?
Don’t worry, we’ve got you covered!
RAID 5 has parity information that is distributed across the drives. Because of that, TaskForce now can automatically reassemble RAID 5, even when you don’t know that one drive is missing.
Run RAID autodetection and see the magic happening. TaskForce identifies RAID type and checks millions of possible RAID configurations to find a suitable one. To make RAID autodetection run even more smoothly, we’ve enhanced the file system validation algorithm.
If one of the array members is missing, TaskForce now automatically detects that and reconstructs the whole array anyway.
After that, you can apply detected RAID 5 configuration and proceed to physical or logical imaging of the RAID.
Securely wipe NVMe drives
Now you can securely wipe M.2 NVMe drives using our M.2 forensic hardware extension module.
We’ve added Format NVM wiping method to TaskForce Wipe settings page. This method uses SSD controller’s internal wiping algorithm according to FORMAT NVM command specified in NVM Express Base Specification.
You can choose between two erase modes, both of which follow NVMe standard:
- If you select Cryptographic erase checkbox, all the user data from NVMe drive will be erased cryptographically. This is accomplished by deleting the encryption key. If the drive doesn’t support cryptographic erase, this option is unavailable.
- If you clear Cryptographic erase checkbox, all the user data from NVMe drive will be erased, the contents of the user data after the erase is indeterminate. The user data may be filled with zeroes, ones etc., depending on the manufacturer’s wiping algorithm.
Manage several user profiles for one TaskForce unit
Do you take your TaskForce with you to work in the field and want to restrict access to it with a password? Or, maybe, you share one TaskForce unit with several colleagues in a lab, but all of you work on different cases and mustn’t see each other’s cases?
To help you deal with that kind of issues, we’ve developed a user management system for TaskForce:
- Create one or several user profiles.
- Protect user profiles with passwords.
- Grant access to your TaskForce only for authenticated users.
- See and manage your cases independently.
- Automatically lock TaskForce screen after a certain time of inactivity.
To create and manage several user profiles, enable multi-user mode in TaskForce settings and create first profile with Admin role. Add other user profiles for your colleagues, if needed.
Now, before getting you to the home screen and your cases, TaskForce will ask you to enter your username and password. Your colleagues, who use TaskForce with you, won’t see your cases, and you won’t see theirs.
Changelog
New Features
RAID:
- New stage 4 of RAID configuration autodetection starts in case three initial stages were unsuccessful: automatic search of a missing device in RAID 5.
- APFS support (unencrypted volumes only).
- Improved RAID autodetection due to an enhanced file system validation algorithm./li>
- Partition table in a tooltip for MBR device tag.
Logical imaging:
- APFS support, including encrypted volumes.
- ZIP file supported as a target logical container.
- New Web API call: /start-logical – launches logical imaging session to L01 or ZIP.
- New button ‘Check’. Allows to check the specified file filters and download the matched files as CSV.
Express mode: USB drives supported.
Wiping: New ‘Format NVMe’ method for NVMe SSDs.
Diagnostics:
- AMA max address detection during firmware check.
- Shows APFS volumes and containers.
HPA, DCO, and AMA: Other tasks > Hidden drive areas. New functionality enables changing and unclipping of HPA, DCO, and AMA.
New user management system:
- It can be activated in System settings.
- Admin & User roles.
- Case access restrictions by user.
- Auto-lock screen with user password.
Case management:
- One case can include multiple drives.
- Same drive can belong to multiple cases.
AFF4 image file reading and validation. Performance increased by 120%.
Imaging: Adjacent single read errors in the logs are merged into sector ranges. It makes log smaller when imaging a damaged drive.
QR code added to ease TaskForce activation.
Bugfixes
Imaging of WD_BLACK NVMe drives could not be started due to underscore in the model name.
Incorrect behavior during Resume of a paused imaging session to an image on a powered-off Storage drive.
Failed to open network shares with passwords containing several special characters (e.g. ! , : “).
Diagnostics:
- Rare head check error possible on old IDE drives.
- Rare specific error when reading SMART temperatures and not showing the graph.
RAID: Too many Mirror tags when all devices have the same data.
Issue with FAT32 file extensions in Logical and Browse Files.
Download
To get access to all new TaskForce features, download latest TaskForce firmware from our website.
Where to buy
To order Atola TaskForce hardware unit or latest software updates, contact Atola Technology directly or find a distributor near you.
To get more information about Atola TaskForce or discuss the details, please contact Atola Technology sales department:
- Call us: +1 888 540 2010, +1 416 833 3501 10AM-6PM ET
- Or email us
- Insight Forensic 5.6 – Now with Btrfs and LVM support - December 10, 2024
- TaskForce 2024.9 update – Templates for target files - September 26, 2024
- E01 vs AFF4: Which image format is faster? - July 9, 2024
Sergiy Pasyuta
Sergiy is an experienced technical writer with a passion for simplifying complex concepts in user manuals. With a keen eye for detail and a knack for clear communication, he crafts articles that guide users through our products’ functionalities.
