When the target drive is larger than the source evidence drive, the target hash will not be identical to the hash of the source. To avoid this, you can limit the drive space by enabling HPA to a SATA target.
Create a new E01 file, to which you will image your evidence and select both MD5 and SHA1 hashes to be calculated in the course of imaging.
SMART table is a valuable source of information about a hard drive’s health. SMART (Self-Monitoring, Analysis and Reporting Technology) provides stats of a drive’s operation, thus helping predict its future failure.
If you need to create multiple images of a drive for different purposes, with Insight you can image to three targets simultaneously.
Every once in a while forensic examiners come across hard drives that get shorted. In most cases, a drive has become shorted after experiencing overvoltage either due to a power supply failure or as a result of a user error. Here is what happens to drive in these scenarios and how to fix this.
In TaskForce, Jumbo frames are activated by default to ensure maximum data transfer rates when imaging to a file on your server.
Atola TaskForce’s case management system allows you to print out all reports concerning your evidence, whether it is about dignosing, imaging, calculating hash or any other action.
We have just released Atola Insight Forensic 4.12 with Image file on source drive, automatic exFAT partition creation with performance-optimized parameters, hidden Smartware area detection for WD USB drives and other new exciting features!
This video explains how to image an NVMe drive to a file on your local network with Atola TaskForce. The image file is located on a local network. For more information about network setup and configurations, please follow this guide. NVMe imaging is possible with Atola M.2 SSD adapter.
Thunderbolt extension enables TaskForce to operate on all MacBooks with these interfaces: FireWire, Thunderbolt 2 and Thunderbolt 3 (2016 – 2017 models). There is no need to remove the SSD, Thunderbolt extension allows connecting the whole Apple laptop to TaskForce. Moreover, it is possible to work with all the recent MacBooks that have their SSDs soldered in. The extension module comes with: Thunderbolt 3 to Thunderbolt 2 adapter (by Apple) Thunderbolt 2 to FireWire adapter (by Apple) FireWire cable (comes in white or black color) Connecting MacBook to TaskForce unit In the Enter MacBook serial pop-up window, enter the serial number located on the bottom side of the MacBook and Read more…
