Today we are introducing the largest firmware update of Atola TaskForce ever – 2020.7. It adds a new facet to the product turning it into the first forensic hardware RAID imager in the world and forensic RAID rebuild effortless!
I’d like to start by revealing the pain digital forensic experts have these days.
Quotes of forensic examiners about RAID image acquisition:
“How would one go about imaging a “RAID server”
“I will normally use <data recovery tool> to reconstruct they RAID as I like their interface and the ability to manually select different RAID parameters.”
“I am looking for options to Image a RAID storage on a windows 10 computer”
“…image the drives individually, and then rebuild the RAID from the images. You would need to know the RAID type, drive order and stripe size, to rebuild.”
“I have 4 hard drive E01s that make up a RAID 10. I’ve got the stripe size and the order of the drives. Does anyone know of software that can be used to rebuild this so I can do analysis on it?”
“Personally, I hate rebuilding RAIDs”
“I have a Acer Predator Trion 500 laptop with two PCIe (NVME) drives setup as a RAID0. I’m now trying to figure out the stripe size of the raid but fumbling in the dark…”
We are excited and take pride in how the new RAID module will save time and energy for forensic examiners dealing with such tasks.
How forensic RAID rebuild works
In a nutshell, your happy path in Atola TaskForce 2020.7 is this:
- Select RAID array source devices (drives, raw or E01 image files)
- Wait a couple of minutes until Possible configuration hint pops up
- Click Apply
- Click Go to Image
What is the most impressive thing about rebuilding RAID arrays in TaskForce?
- In many cases, you do not need to have RAID-related knowledge: RAID types, block size, orders, how RAID data is organized, etc. TaskForce automates the configuration selection process to the max.
Is every case that perfect?
Not yet:
1. In excessively complex cases, there can be multiple hints that require manual selection. For instance, TaskForce can detect RAID 10, showing which drives/images are mirrors of each other. Then it gives a hint of how to split it into two RAID 0 arrays and work with one of them.
2. Another example is the handling of 8+ drives/images in the RAID array is not yet optimized speed-wise.
The good news is that we are committed to improving it all very soon in the TaskForce firmware update 2020.7.1!
What is currently supported
- TaskForce 2020.7 firmware supports RAID 0, 1, 5, and JBOD.
- Partition preview works with NTFS and ext4/3/2 file systems so far.
Atola dev team will be adding new RAID types and file systems in the next releases. We believe forensic RAID rebuild is one of the most valuable product features for the industry.
Automated detection of RAID configuration
Let’s delve into the main UX mechanics built into the new RAID rebuild.
You don’t know the configuration, but you have an assumption. My advice is to try it out immediately. It leads us to one of the main features. Any RAID configuration change you perform prompts the bottom Partitions panel to refresh. If the configuration is correct, file systems are found and validated, you will see folders and files below.
This way you quickly receive feedback from your actions and can manually specify the correct RAID drive order and block size if you know the right configuration or have educated guesses to try out.
The smart auto-detection module helps out when you have no idea about the RAID configuration. Just follow its hints. Don’t hesitate to click Apply as soon as a Possible configuration hint appears! It makes forensic RAID rebuild faster, checking all possible configurations for you.
2020.7 changelog
New features
RAID support:
- Autodetection of RAID configuration
- Convenient assembly with partition preview
- Supported RAID types: RAID 0, 1, 5 and JBOD
- Missing drive support in RAID 5
- Supported file systems for RAID autodetection: NTFS, ext4/3/2
Imaging:
- Imaging assembled RAID array or its individual partitions
- Add, change and delete passes of a paused imaging session
- E01 evidence number, investigator, description are added to the final imaging report
- Ability to restore image file to 4Kn drive
- Save report in the target folder option became enabled by default
Case management:
- SAVE TO button on Reports page. Allows to quickly save and export selected reports in a single ZIP file.
- Remote work folder. Performance optimization for cases when 15+ tasks are running simultaneously.
- Improved report search for non-English languages
- Ability to reindex currently selected Work Folder
Support of SAS drives with sector size above 4096 sectors
UI changes on the device selection panel
- Fast device actions: Power on/off, Reidentify, Unmount storage
- Device power indication
Home page. Specific port indicated for each device report
Bugfixes
- Imaging to E01 could not get started if source device’s serial number was longer than 50 characters
- Resuming imaging session could fail if target image folder is password-protected
- Out of memory error while importing large work folder package files
- Possible minor issues with segmented hashes after imaging paused and resumed
- Fixed HTML styling when a case report is opened outside TaskForce
- Seagate SSD 600 Pro drive was not detected in the device selection panel
- Incorrect values of Last open date in Cases page
Download
You can download the latest update here: TaskForce firmware
Where to buy
If you still do not have an Atola TaskForce and would like to place an order, this can be done directly via Atola Technology, or from a distributor near you:
Please contact Atola Technology sales department to receive more specific information:
- Call us: +1 888 540-2010, +1 416 833-3501 10am – 6pm ET
- Or email us
P.S. Dear customers, we appreciate your feedback and take it into consideration when updating our products, feel free to write your thoughts and ideas in the comments section below.
He believes in saving time & energy of people doing mission-critical work. Therefore, all his efforts are focused on leading R&D of innovative Atola products.
Gamification enthusiast. Agile development proponent.
- Atola TaskForce 2023.4.2 stability update - August 7, 2023
- Wipe multiple drives in Atola Insight Forensic 5.2 - May 26, 2022
- Logical imaging in TaskForce 2022.4 - April 11, 2022
Vitaliy Mokosiy
Atola CTO He believes in saving time & energy of people doing mission-critical work. Therefore, all his efforts are focused on leading R&D of innovative Atola products. Gamification enthusiast. Agile development proponent.
