Q&A about Atola products at Techno Security San Diego 2021

2021 has brought offline events back, and we enjoyed great conversations with customers and friends again. Here are some of the topics discussed at the most recent conference, Techno Security & Digital Forensics 2021.

Now that Insight supports 3 parallel imaging sessions with DiskSense 2 hardware units, how is the product different from TaskForce?

The current generation of Insight hardware is equipped with a server-grade motherboard and CPU just like TaskForce. However, the two products still have substantial differences in terms of their hardware parameters (such as the number of ports and how they are configurable between source and target, CPU capacity, etc.). These differences have defined the ways in which these forensic imagers have developed over the years. To name a few key differences:

TaskForce

• is equipped with 18 ports, and each can be configured as a source or a target. This allows acquiring data from up to 18 imaging sessions at 15 TB/hour of overall capacity!
• has performance-oriented features like Express mode and Multi-launch.
• Web API enables TaskForce’s integration into third-party tools, such as Magnet Automate.
• its unique configuration autodetection module automatically identifies a RAID with an unknown configuration, mounts and images such arrays.
• is a standalone tool equipped with a touch screen, easily packed thanks to a magnetic screen-protecting cover.

Insight Forensic

• has low-level data recovery and security features like the recently added Locate Sectors, or Device Features (which helps configure a drive’s power management or caching), and other disk utilities.
• selective imaging of separate files, partitions using File Recovery module.
• has a unique Artifact Finder feature that scans data at the sector level (the artifacts may belong to the existing files or the remnants of previously deleted files) and provides sector view for easy artifacts’ context overview.
• automatic ATA password identification and removal.

Both products have this key functionality:

• diagnostics module (to check a drive’s health status, estimated imaging time and filesystem identification).
• fast imaging at the top native speed of the drive.
• multi-pass imaging system for automated data recovery from damaged drives, automated handling of freezing drives.
• hashing (linear/traditional, segmented for damaged drives).
• HPA & DCO restricted areas identification and automated reset.
• wiping with multiple methods including Secure Erase.
• partition preview.

Please note that both units are now equipped with ECC RAM for data accuracy.

Can TaskForce identify a RAID’s unknown configuration if you include drives that are not RAID members (the drives are not marked properly)?

Normally, if you connect a range of drives that constitute a RAID, TaskForce will be able to identify the type of the RAID within the first minute of the configuration autodetection process. TaskForce reads data from the initial 3M sectors of each drive and searches for the correct relation between the members of the RAID.

If there is a drive that is not part of the RAID, the module will spend more time identifying the configuration.

• In case of RAID 1 or 10, the RAID module will group the detected mirrors into corresponding groups, and the odd drive will be placed separately, the partitions will be mounted successfully.
• If it is a JBOD, the partitions of such array will likely be identified and the order of the drives will be correct, with the odd drive placed at the end.
• In the case of RAID 0 or 5, TaskForce may not be able to reassemble such array, because the data from the odd drive will be taken into consideration when the RAID module tries to combine the data from all the members. TaskForce’s autodetection module will try identifying the configuration from scratch each time you remove or add a drive, so you can try removing a drive that seems odd.

Of course, it is common sense that drives that constitute a RAID have the same capacity and more often than not, they will be of the same type, made by the same manufacturer, etc.

Is Atola planning to discontinue the support of DiskSense units (manufactured between 2014 and 2021)?

Both Atola TaskForce and Atola Insight Forensic are in high demand and have strong user bases. We are not planning to discontinue either of these imaging systems. In fact, we have a few years’ worth of new exciting features planned for both systems.

DiskSense hardware units (the first generation of hardware for Atola Insight Forensic imager) will continue to be supported in the foreseeable future and will include the same features as the new, higher-capacity DiskSense 2 hardware units.

We at Atola stand by our products. Remember that your system is covered by a lifetime warranty for as long as you keep your subscription active. The subscription’s other benefits include software updates and fast and effective support from our team of engineers who develop the software and know all ins and outs of the product.

Can TaskForce be used as a wiping tool?

Absolutely! One of TaskForce’s major benefits is its easily configurable ports. When in target mode, each of the 18 ports is not write-protected and can be used for a wiping operation.

Furthermore, by ticking the Multi-launch box in the port selection panel, you can reduce the number of clicks to the bare minimum. Multi-launch allows you to select any number of devices connected to the ports in target mode. This turns your TaskForce into the ultimate wiping solution that can wipe up to 18 drives in one go.

Do you have more questions?

We look forward to new events and to hearing more of your questions, no matter how challenging! Feel free to send us a note or leave a comment below.

• Author
• Recent Posts

Yulia Samoteykina

Director of Marketing

Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.

Latest posts by Yulia Samoteykina (see all)

• Top digital forensic conferences in 2024 - January 1, 2024
• 2023. Year in Review - December 31, 2023
• Top digital forensics conferences in 2023 - January 1, 2023