Atola Blog

RAID configuration autodetection
Atola TaskForce

RAID configuration detection in Atola TaskForce

With RAIDs landing on forensic examiners’ desks often being completely anonymous, finding the correct RAID configuration becomes a tedious manual job that can take hours and days to complete.  To make this process efficient and effortless, Atola developers equipped TaskForce forensic imager with a breakthrough configuration autodetection module. This time-saving solution automates the configuration search and allows the operator to focus on the more urgent tasks that require human attention. TaskForce Autodetection module TaskForce’s RAID configuration autodetection process commences immediately upon selection of the RAID members, which can be any combination of devices and image files.  In Stage 1,  the autodetection module reads data on the drives to determine the Read more…

By Olga Milishenko, ago
Atola TaskForce

Imaging RAID 5 with a missing device

When it comes to RAID imaging, a forensic specialist may be confronted with an array that not only has an unknown configuration but also one of the drives severely damaged or missing. This is when Atola TaskForce comes to the rescue! If this is a RAID 5 with a missing device, TaskForce uses the array’s redundancy to create a full image of the RAID. All you need to do is select all available RAID members and click the Add missing device button. Auto detection module will recommence when a new image file or device is added. TaskForce can identify the right configuration and reassemble the RAID, using redundancy. When a Read more…

By Olga Milishenko, ago
RAID 5 imaging session
Reassembling RAID 5 array
Atola TaskForce

Imaging RAID 5 array with errors on multiple drives

When imaging RAID 5 array with errors on multiple drives, Atola TaskForce is still able to detect its parameters and image the whole RAID. Let’s examine a case with a RAID 5 consisting of 5 drives, two of which have bad sectors. Reassembling RAID 5 array with errors on multiple drives Click the RAID button in the left-side taskbar and select the drives that make up the RAID array.  TaskForce autodetection module starts running immediately upon selection of the RAID members. In Stage 1, TaskForce reads data on the drives to identify the RAID type. In case it runs across an error, it displays an Error tag next to the corresponding RAID Read more…

By Olga Milishenko, ago
Atola Insight Forensic

Atola Insight 4.17 with AFF4 support

Our dev team has decided to celebrate 2021 with a new software update. With this release, Atola Insight Forensic has become the first forensic hardware imager in the world that is able to image into AFF4 files! Here is why AFF4 support is so important. AFF4 imager So what’s the big deal about AFF4? This file format has several upsides: Open-source format: you can describe it in a court Fast compression methods: Snappy and LZ4 Block hashes It stores binary zeroes as spans (in a “sparse file” manner) Vendor-neutral Since our team is always focused on performance and AFF4 is a highly optimized file format, Insight’s imaging speed will be Read more…

By Vitaliy Mokosiy, ago
Calculating entropy during imaging
Atola TaskForce

The importance of ECC RAM in forensic imagers

When working with evidence drives, data integrity is critical. Using ECC RAM, which identifies and corrects common single-bit errors, would help dramatically improve data transfer reliability in digital forensic tools. Why use ECC memory Electrical, magnetic or even radioactive interference inside a system, may cause a single bit of DRAM (Dynamic Random-Access Memory) to flip to the opposite state, resulting in an error. While the single-bit error in an ordinary situation could be harmless or have a comparatively mild effect (like a wrongly colored pixel in a .jpeg file), in forensic imaging, it means that the whole image you get is compromised. Because the hash of the image won’t be Read more…

By Olga Milishenko, ago
Multiple imaging sessions
Atola TaskForce

How to benefit from the range of sources and targets in Atola TaskForce

How often are you faced with a case with multiple individual devices with different interfaces (HDDs, SSDs, NVMe, USB, etc.) or a whole RAID array? If all you have on your hands is one imager with no parallel imaging capacity, it can result in a prohibitive processing timeline. To help you tackle such cases, we equipped TaskForce with huge performance capacity, backed by server-class hardware: TaskForce handles 12+ parallel imaging sessions on its 18 ports. In this blog, we show how the range of sources and targets you can use for imaging. Atola TaskForce’s configurability: the range of source and targets The product has been designed with the configurability, flexibility, Read more…

By Olga Milishenko, ago