Atola TaskForce

Working with MacBooks via Thunderbolt extension module

Thunderbolt extension enables TaskForce to operate on all MacBooks with these interfaces: FireWire, Thunderbolt 2 and Thunderbolt 3 (2016 – 2017 models). There is no need to remove the SSD, Thunderbolt extension allows connecting the whole Apple laptop to TaskForce.  Moreover, it is possible to work with all the recent MacBooks that have their SSDs soldered in. The extension module comes with: Thunderbolt 3 to Thunderbolt 2 adapter (by Apple) Thunderbolt 2 to FireWire adapter (by Apple) FireWire cable (comes in white or black color) Connecting MacBook to TaskForce unit In the Enter MacBook serial pop-up window, enter the serial number located on the bottom side of the MacBook and Read more…

Atola TaskForce

Calculating dual hash of an existing E01 file

Some source evidence drives and their images can be involved in a long-running investigation case and wait to be presented in court for months or years on end. Data stored on such drives and their image files may eventually get corrupt. Therefore it may be critical for an investigator to ensure the integrity of data on such devices or image files before resuming to work with them or presenting them in court. Over the years, E01 file format has become a popular format for forensic purposes due to its ability to store not both the image of the drive, but also case and evidence details. E01 file can also contain Read more…

Atola TaskForce

Using extension modules with TaskForce

TaskForce system allows expanding its compatibility with other device interfaces via hardware extension modules. How to plug an extension module TaskForce system must be powered off before an extension module can be plugged: Power off TaskForce Plug extension module into the Extension port Power on TaskForce Thunderbolt extension module With the help of Thunderbolt extension module TaskForce supports imaging, hash calculation, write protection on MacBooks with these interfaces: FireWire, Thunderbolt 2 and Thunderbolt 3 (2016 – 2017 models). Connecting MacBook via Thunderbolt extension module Connect MacBook to TaskForce unit with the help of Thunderbolt extension and the FireWire cable. Use adapters if needed (included). To boot MacBook in Target Disk Read more…

Atola TaskForce

Lifting HPA and DCO with Atola TaskForce

Host protected area (HPA) and device configuration overlay (DCO) are special hidden areas. They were developed as a feature by hard drive manufacturers for secure storage of vendor utilities or to make a drive appear to have smaller capacity than the drive actually has. But for a while now, proficient users have known how to create and modify them, store data there, etc., by using open source tools. The ability to detect such areas on a drive and image the whole drive space, including HPA or DCO-protected parts, becomes critical for forensic examiners. Otherwise, the evidence they get may be incomplete and lead to inaccurate investigative conclusions. Once you plug a Read more…

Atola TaskForce

Calculating hash in the course of imaging

Atola TaskForce supports hash calculation of both the evidence drive and the image in conjunction with imaging. We have developed highly flexible functionality to help optimize evidence acquisition process to fit one’s internal procedures while avoiding further damage to fragile media. To calculate hash of both the evidence and the image: Click Image category of the left-side menu Select the Source device and the Target device or file Click Change button in the Settings summary page In the Hashes tab there are three checkboxes: Pre-hash source device Hash source during imaging Post-hash target device   Multiselect is available, which allows a user to use all three of these options. However, Pre-hash source Read more…