The new TaskForce firmware update brings a number of great enhancements, primarily to the imaging of drives and RAID arrays.
XFS is a popular high-performing filesystem in the Linux world. It is now supported throughout the TaskForce functionality. Most importantly, in these three modules:
- Imaging (All sectors with data option)
- RAID autodetection
- Browse files
HEX viewer and Signatures tabs in Imaging
Along with the Log tab in the bottom part of the imaging progress screen, there are now Hex viewer and Signatures tabs:
- HEX viewer tab shows the real-time sectors read result in two modes (HEX and ASCII) and allows freezing them for a closer look.
- Signatures tab: shows you the number of predefined/custom file signatures found on the drive and gives access to the statistics.
These tabs help understand what is being imaged and reprioritize your imaging tasks if necessary. For example, when you notice during imaging that File signatures count equals zero, it is due to one of the following reasons:
- Blank evidence drive
- Encrypted partition(s)
Switch to the Target HEX viewer tab. If you see zero sectors only, it is a blank drive. If you see random data being updated every second, most likely, all the data resides inside one or more encrypted partitions.
In addition to RAID 0, 1, 5 and JBOD, TaskForce now supports RAID 10! This RAID type is popular in production and hosting servers for its high performance and data security properties. It is frequently encountered by investigators, and often as a set of drives with an unknown configuration. Our autodetection module helps arrange them in the right order and suggests suitable RAID configurations.
- Live stats of file signatures
- Target HEX viewer with the imaged raw sector data displayed in real-time with a freeze option
- Fast RAID 10 imaging
- XFS support when imaging only sectors with data
- RAID 10 autodetection and group management
- XFS support
- Enhanced RAID autodetection algorithm
Diagnostics. USB drive supported
Other > Browse files. XFS supported in the file system preview
In Web API, /check-task query has a new result field: hashes
In reports and running tasks, the top right Case ID is clickable for identifiable devices
- Imaging could fail to start when switching settings from Linear hashing to Segmented hashing and disabling all hash types
- few UI fixes of imaging presets
Some models of USB flash drives had an incorrect capacity
Rare case when opening network folders was too slow during image file selection
RAID-mounted drives could be mistakenly powered down when staying in idle mode for 5 minutes
Diagnostics. Invalid “The motor does not consume proper current on spinup. The motor may be stuck, or the circuit board is malfunctioning.” diagnosis for SSDs with non-working PCB
File manager. “Create file” button was missing after unlocking a password-protected network folder
Express mode. “User action required” dialog was not showing for Resume and Retry imaging situations
It was impossible to set a non-Latin Case ID
You can download the latest update here: TaskForce firmware
Where to buy
If you still do not have an Atola TaskForce and would like to place an order, contact Atola Technology directly or a distributor near you: https://atola.com/wheretobuy/
Please contact Atola Technology sales department to receive more specific information:
- Call us: +1 888 540-2010, +1 416 833-3501 10am – 6pm ET
- Or email us
P.S. Dear customers, we appreciate your feedback and take it into consideration when updating our products, feel free to write your thoughts and ideas in the comments section below!
Director of Marketing Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.