Atola TaskForce

The importance of ECC RAM in forensic imagers

When working with evidence drives, data integrity is critical. Using ECC RAM, which identifies and corrects common single-bit errors, would help dramatically improve data transfer reliability in digital forensic tools. Why use ECC memory Electrical, magnetic or even radioactive interference inside a system, may cause a single bit of DRAM (Dynamic Random-Access Memory) to flip to the opposite state, resulting in an error. While the single-bit error in an ordinary situation could be harmless or have a comparatively mild effect (like a wrongly colored pixel in a .jpeg file), in forensic imaging, it means that the whole image you get is compromised. Because the hash of the image won’t be Read more…

Atola TaskForce

How to benefit from the range of sources and targets in Atola TaskForce

How often are you faced with a case with multiple individual devices with different interfaces (HDDs, SSDs, NVMe, USB, etc.) or a whole RAID array? If all you have on your hands is one imager with no parallel imaging capacity, it can result in a prohibitive processing timeline. To help you tackle such cases, we equipped TaskForce with huge performance capacity, backed by server-class hardware: TaskForce handles 12+ parallel imaging sessions on its 18 ports. In this blog, we show how the range of sources and targets you can use for imaging. Atola TaskForce’s configurability: the range of source and targets The product has been designed with the configurability, flexibility, Read more…

Atola TaskForce

Imaging RAID 0 array

TaskForce has a unique RAID configuration detection module. Furthermore, it is able to sustain multiple high-speed imaging sessions on its 18 ports. This makes it a perfect imager to perform reassembly of RAID with an unknown configuration and fast forensic imaging of such arrays. Here is how imaging RAID 0 array becomes an effortless job! Assembling a RAID 0 array To assemble RAID 0, follow these steps: Connect the drives that make up a RAID array to the TaskForce hardware unit. Most importantly, make sure to switch the ports to the Source mode; Click the RAID button in the left-side taskbar 3. Select the drives in Select source device panel and Read more…

Atola TaskForce

Imaging RAID 5 array with Atola TaskForce

Atola supports RAID imaging and provides a breakthrough configuration autodetection module for RAID 0, 1 and 5 with NTFS and ext4/3/2 file systems. More RAID types and file systems will be supported in the upcoming releases with RAID 10 coming by the end of 2020. Here is how to make a RAID image from RAID 5 with an unknown configuration. The RAID array can be imaged as a whole only its individual partitions.

Atola TaskForce

Forensic RAID rebuild in Atola TaskForce 2020.7

Today we are introducing the largest firmware update of Atola TaskForce ever – 2020.7. It adds a new facet to the product turning it into the first forensic hardware RAID imager in the world and forensic RAID rebuild effortless! I’d like to start by revealing the pain digital forensic experts have these days. Quotes of forensic examiners about RAID image acquisition: “How would one go about imaging a “RAID server” “I will normally use <data recovery tool> to reconstruct they RAID as I like their interface and the ability to manually select different RAID parameters.”  “I am looking for options to Image a RAID storage on a windows 10 computer” Read more…

Atola TaskForce

Damaged drive imaging with TaskForce: A drive with a damaged head

A damaged hard drive, especially when it comes to evidence drives, requires a complex imaging approach. It is necessary to avoid the drive’s further deterioration and data loss during damaged drive imaging. TaskForce system enhances your working with damaged evidence drives, minimizing the risk of losing data on the functioning parts of the head stack.  Diagnostics and selective head imaging TaskForce’s built-in drive diagnostics module automatically checks all subsystems of the evidence drive. At the end of the diagnostics process, it provides a clear and detailed report about its electronics and motor, head stack, media surface, firmware and file system.  In the Heads section of the diagnostics report, TaskForce forensic Read more…

Conferences

Q&A during the Interpol Digital Forensics Expert Group 2020

On Tuesday, June 16 Atola’s Yulia Samoteykina spoke at Interpol’s annual Digital Forensics Expert Group. After the presentation about our imagers’ multi-pass imaging system and other damaged media functionality, we received a few follow-up questions. In this blog we would like to reiterate the answers to these questions: Can Atola imager acquire evidence from damaged SSDs? As is true with any type of media, the degree of damage will inform how we can help with data recovery from a specific device. SSD failures fall into three major categories: logical errors, hardware issues, firmware failure.  Atola imagers may be able to image data from an SSD with logical errors or hardware Read more…