You remember segmented hashes, right? They’re what you want to use to verify an image of a damaged drive: after multipass imaging of a damaged drive in TaskForce, these hashes are calculated only for the good areas of a drive.
Segmented hashing also does its job when the classic linear hashing fails. By verifying all segmented hashes in a set, you can prove that the entire image has not changed over time. Even if the hash of one damaged segment becomes invalid, you still have all the other good segments with their valid hashes.
But how do you verify segmented hashes? Previously, you could do it using our open source tool named seghash. Now, you can complete this task both for target physical drives and image files right in the TaskForce interface:
- Go to Other > Verify segmented hashes.
- Select a target drive or image file you want to verify. E01, AFF4, and Raw file formats are supported.
- Select a CSV file with segmented hashes that belongs to your image.
If TaskForce encounters a hash value mismatch, you’ll see it in the Hash mismatches counter and in the event log, where the Start and End LBA of the respective segment will be listed.
Once the verification is finished, you’ll get a detailed report about its results.
TaskForce 2024.1 Changelog
New features
Verify segmented hashes, a new task in the Other section. It helps double-check segmented hashes in the CSV file created during imaging for any type of target: E01, AFF4, raw image, drive.
System settings:
- Automatically create a subfolder using the target file name option. If enabled, the target image will be created in a subfolder of a selected target folder.
- Clear local and session storage button. Any settings or temporary data stored in Chrome for the TaskForce web application will be permanently deleted.
Clickable device header in a case report. It navigates to the device information page if the appropriate device or image is available/connected.
Bugfixes
Failed to open E01 files created by the UFS Explorer.
Logical imaging. Check > Download was not handling commas in a generated file name list properly, which broke the CSV format.
Reports. Possible first blank page when selecting a report from the list to print.
Minor fix of Other > Customize taskbar and Browse Files compatibility.
- Insight Forensic 5.5 – Image 3 iSCSI drives in parallel - April 4, 2024
- TaskForce 2024.1 update ‒ Verify segmented hashes - January 26, 2024
- Customize the Taskbar in the TaskForce 2023.11 update - December 11, 2023
Sergiy Pasyuta
Sergiy is an experienced technical writer with a passion for simplifying complex concepts in user manuals. With a keen eye for detail and a knack for clear communication, he crafts articles that guide users through our products’ functionalities.
