With time often being an issue, the ability to perform selective imaging becomes vital. Especially when dealing with RAID volumes that in our day and age reach dozens of terabytes in capacity. Here is how TaskForce’s RAID functionality helps you minimize imaging time by imaging partitions of a RAID array.
Once you have selected the drives that make up a RAID array, wait for a Possible configuration suggestion to show up. Then click the Apply button. TaskForce automatically arranges the drives in the correct order and applies other configurations: RAID type (level), Start LBA, block size, etc.
Once you have applied the configuration, TaskForce identifies and verifies the file system. If the file system has been successfully verified, the Partition preview part of the RAID screen allows browsing through the partitions and folders. This may help find potential evidence and prioritize the partitions accordingly.
To image a specific partition, click Go to image button and in the imaging settings. Then click All sectors area and switch to All sectors with data in the drop-down menu.
Next, select the partition for imaging and save the settings. Now you are ready to start imaging partitions of a RAID!
When you click the Start button, the imaging session will commence. This imaging will take a fraction of the time required for the imaging of the whole RAID array.
The Imaging completed report will indicate the partitions and sector ranges imaged.
We introduced the RAID functionality in TaskForce with the software version 2020.7. Currently, TaskForce supports RAID 0, 1, 5 and NTFS and HFS file systems. We will support more RAID types and file systems in the upcoming releases.