At last! The newest version of TaskForce firmware introduces an improved RAID module with support for Synology NAS systems, Btrfs, and LVM (Logical Volume Manager), along with other top-shelf features such as the ability to group ports in Express mode and assign different imaging settings for each group. Also, we’ve added built-in user hints and an offline help system to ease your learning curve and provide instant advice.
Let’s take a closer look at the main improvements and tweaks we’ve prepared for you in the new TaskForce update!
Reassemble Synology NAS RAIDs automatically
TaskForce forensic imagers now offer system-wide support for Synology Network Attached Storage, including SHR RAID management system, Btrfs file system, and Logical Volume Manager (LVM), which are widely used on Synology devices.
You can now automatically reassemble such RAIDs and then create their full bit-by-bit copies or image only selected partitions, folders, and files to save time and storage space.
TaskForce’s Autodetection module also provides detailed information about all the RAID arrays that constitute a particular Synology storage pool.
Image other RAIDs with greater ease
Apart from the mentioned Synology NAS support, we’ve also enhanced our RAID module with other useful features.
Set up the Start LBA for RAID autodetection: if you know that members of the array have a particular disk offset, you can specify that parameter in the Autodetection module (look for the gear icon). This way, autodetection can find a suitable RAID configuration in the cases where it didn’t work before.
Express mode. Port groups with different settings
To streamline your workflow, TaskForce in Express mode starts the imaging process with predefined settings automatically once you connect a drive. But what if you deal with different types of drives that require different approaches?
With the new update, you can combine any number of TaskForce ports into a custom group with specific imaging parameters for Express mode:
- Where to save an image file
- Which image file format to use
- Which type of hash to calculate
- Whether to diagnose source device before imaging
- How to fill in case report fields: Case ID, Organization, Investigator
For example, to balance image acquisition time, you can image new NVMe drives to your faster server and older/smaller SATA drives to a slower storage. Or image healthy drives to the “Good” network folder and faulty ones to the “Bad” network folder to treat them differently later.
Get a quick advice on how to use TaskForce
Feeling unsure about what this or that TaskForce feature does and how to use it? Now you can benefit from a built-in contextual help system available offline.
Look for an underlined header in the TaskForce interface, click it, and get a detailed step-by-step guide on the topic.
Your learning curve doesn’t have to be steep!
TaskForce 2024.6 Changelog
New features
RAID:
- Full automatic reassembly and imaging support of Synology NAS RAID.
- New Layout tab to visualize selected RAID configuration.
- Autodetection module. New Start LBA parameter to specify RAID offset used by autodetection (Gear button).
- Improved memory use + performance optimizations.
- Expand/Collapse buttons for the RAID configuration and the Partitions panels to improve UX.
Imaging:
- Improved capability to resume imaging in case of power or network connection loss.
- BitLocker volume GUID added to the imaging log.
- Post-hash mode + Segmented hashes selected. It creates a CSV file in addition to the performed verification.
Express mode imaging:
- Port groups. Ability to image some ports to one folder with specific settings and other ports to another folder with different settings. There can be more than 2 groups.
- AFF4 added as a selectable imaging target.
- New settings: Case ID, Organization, Investigator.
Logical imaging:
- Wildcards (*, ?) support in file/folder filters.
- Check button enabled for reassembled RAID while autodetection is still running.
System-wide Btrfs support.
System-wide LVM (Logical Volume Manager) support.
Web API:
- Ability to use API when the user management system is activated.
- New POST call /login.
- New GET call /diagnose.
Diagnose. File system stage:
- Added analysis of ext4/3/2, XFS, HFS+, HFSX.
- BitLocker volume detection with FVE Metadata blocks.
Browse files. New List files as CSV button. Generates list of all files in partitions with optional file hashes and timestamps.
Case management:
- New window to select an existing case to improve UX.
- New global setting ‘Set default values for all cases’. It fills in all new cases’ default values in the Investigator, Organization, and Location fields.
- New option in global settings ‘Show empty case values in report header’ to show or skip the unfilled fields in reports.
Many page headers now link to articles about using TaskForce from the offline manual.
Standalone/Kiosk mode.The offline manual from the main menu opens in a dialog.
New Hints subsystem that displays practical hints to expedite your work with TaskForce based on your behavior. A single hint appears as a notification once. Yet you will be able to find them all in the hint list.
Improved handling of situations when source drive is unplugged before starting a task.
Improved recognition of vendor-specific SMART attributes.
TaskForce 2 only:
- LEDs change their state when the firmware boots or updates.
- New Blink LED operation for each port.
- New Ethernet bonding mode for ETH1 and ETH2 ports.
Bugfixes
Unable to identify USB Seagate One Touch drives.
Imaging:
- Next imaging pass with reverse direction could not start if a source drive had bad sectors during the previous pass.
- Imaging partitions. Incorrect XFS partition size when its allocation group size was different.
- A rare visual representation case with the imaging map graph could result in empty gaps after multiple page refreshes.
RAID:
- Some exFAT partitions may not open in the Partitions tab due to incorrect internal caching.
Diagnose:
- In Multi-launch mode, it could not start when one of the selected drives is not detected.
- IDE drives with working Verify but non-working Read commands could be classified as degraded instead of damaged.
- ‘Unknown device’ in case report header for drives with corrupted firmware.
Web API. /start-image call could not find the built-in Damaged imaging settings.
Possible case report duplication after connection loss and recovery with a remote Work Folder.
Invalid behavior when attempting to start a task against a damaged device with zero byte capacity.
SMART. For NVMe drives, the start page had a description of ATA specification attributes.
Download
To get access to all new features, download new updates from our website:
- for Atola TaskForce
- for Atola TaskForce 2
Where to buy
To order Atola TaskForce or TaskForce 2 hardware unit or extend your subscription, contact Atola Technology directly or find a distributor near you.
To get more information about Atola TaskForce or to discuss the details, please contact Atola Technology sales department:
- Call us: +1 888 540 2010, +1 416 833 3501 10AM-6PM ET
- Or email us
- Insight Forensic 5.6 – Now with Btrfs and LVM support - December 10, 2024
- TaskForce 2024.9 update – Templates for target files - September 26, 2024
- E01 vs AFF4: Which image format is faster? - July 9, 2024
Sergiy Pasyuta
Sergiy is an experienced technical writer with a passion for simplifying complex concepts in user manuals. With a keen eye for detail and a knack for clear communication, he crafts articles that guide users through our products’ functionalities.
