Atola TaskForce’s imaging functionality provides many adjustable settings to help forensic examiners follow the guidelines set by their organizations as well as common-sense evidence handling routines.
When you need to create two images of a source drive and verify that both images are identical to the source drive, you will need to calculate the hashes of both targets after imaging. To optimize the process, post-hashing of both target devices is easily configured in imaging settings:
1) Click Image button in the left-side menu
2) Select Source and Target devices, which will redirect you to the page with the summary of current imaging settings. In the default settings, hashing of source drive during imaging is enabled.
3) Click the Change button to adjust the settings.
4) in the Hashes tab of the settings, enable Post-hash target devices option.
5) Click Start button to proceed with imaging
Hashing of source drive during imaging is a preferred option because it only requires the data on the evidence drive to be read once, for both imaging and hash calculation. This ensures both a forensically sound process and minimal impact to potentially unstable media. Hashing during imaging does not slow down imaging process.
Once imaging is completed, post-hashing begins immediately on both target devices:
In the end, TaskForce produces a report that documents hashes of both source and target devices:
- RAID imaging made easy with Atola TaskForce - May 3, 2022
- Video: TaskForce 2022.4 new functionality walkthrough - April 20, 2022
- When TaskForce’s integration into your automation solution is a game changer - March 16, 2022
Director of Marketing Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users and advocating on the users' behalf to ensure Atola keeps on adding value and raising the bar for the industry.