TaskForce’s RAID functionality has been around for over a year now. Our users have experienced great improvement in their process. RAID 10 imaging is the most recent addition.

RAID 10 is among the most popular RAID types and combines striping and mirroring techniques. This ensures both high performance and data resiliency. A RAID 10 usually consists of an even set of drives, unless three mirrors are used for extra data redundancy.

In September, TaskForce received its 2021.8 firmware update that included RAID 10 support. From now on, our configuration autodetection module helps in case you are dealing with a RAID 10. Even if the type and configuration of the RAID are unknown.

Mounting RAID 10

To start working with a RAID 10, connect its members to TaskForce. Then click the RAID icon in the main menu and select the drives.

Select RAID 10 members

Once you click Continue, the autodetection module starts reading data from the initial sectors of the drives to identify the RAID type in stage 1. In stage 2, it tries out the different parameter combinations (start LBA, block size, etc.). If TaskForce identifies a RAID 10 type array during stage 1, it will immediately arrange the drives into appropriate mirror groups. The mirror groups will be labeled accordingly.

It is only if a filesystem on the array can be successfully verified that you will get a suggestion. Just click Apply.

Click Apply to use the detected configuration

The partition preview allows you to make sure that the configuration worked. A valid folder structure becomes available. Browse through the folders to ensure that the information within may be relevant to your investigation.

Imaging RAID 10

Proceed to image the RAID by clicking the Go to image button and start the imaging session.

Use partition preview

The speed of imaging is up to 400 MB/sec when you image a RAID 10 consisting of HDD drives. It will go to up to 900 MB/sec on a RAID consisting of SSD drives.

If a RAID member has errors, TaskForce will fetch the missing data from the other mirror and rebuild the image accordingly.

RAID 10 imaging

The imaging report will contain both the information about the RAID itself and its participants. It will also have a scope of sectors imaged, the summary of the signatures encountered during the imaging, and, certainly, the log with timestamps.

Imaging RAID 10. Report

To ensure that RAID acquisition is fast and effortless for TaskForce users, we will continue to develop the RAID module. TaskForce will support more popular RAID types and filesystems, and we keep on enhancing autodetection algorithms.

Yulia Samoteykina
Latest posts by Yulia Samoteykina (see all)
Categories: Atola TaskForce

Yulia Samoteykina

Director of Marketing Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.