Atola TaskForce’s imaging functionality provides many adjustable settings to help forensic examiners follow the guidelines set by their organizations as well as common-sense evidence handling routines.
When you need to create two images of a source drive and verify that both images are identical to the source drive, you will need to calculate the hashes of both targets after imaging. To optimize the process, post-hashing of both target devices is easily configured in imaging settings:
1) Click Image button in the left-side menu
2) Select Source and Target devices, which will redirect you to the page with the summary of current imaging settings. In the default settings, hashing of source drive during imaging is enabled.
3) Click the Change button to adjust the settings.
4) in the Hashes tab of the settings, enable Post-hash target devices option.
5) Click Start button to proceed with imaging
Hashing of source drive during imaging is a preferred option because it only requires the data on the evidence drive to be read once, for both imaging and hash calculation. This ensures both a forensically sound process and minimal impact to potentially unstable media. Hashing during imaging does not slow down imaging process.
Once imaging is completed, post-hashing begins immediately on both target devices:
In the end, TaskForce produces a report that documents hashes of both source and target devices:
- XFS, RAID 10 and new imaging features. TaskForce 2021.8 is here! - September 8, 2021
- Imaging and hot plug of NVMe drives with DiskSense 2 - August 19, 2021
- The Story of Atola Insight hardware - July 13, 2021