A situation may occur when multi-target imaging is paused to be continued later, but one or more targets become unavailable. The drive may need to be taken and used by another technician or broken, or the server with the image file may become unavailable. But you may need to finish the imaging to the remaining target asap to start working on the evidence.

It is for such cases that we have added the splitting imaging sessions functionality to the 4.9 release of Atola Insight Forensic.

With the source drive connected to Insight, go to Imaging category and view the details of the interrupted imaging session to several targets. If not all target drives and image files are available, it is impossible to simply resume imaging. However it is possible to split the previous imaging session into separate ones: one per each target. To do that click Split all sessions to separate targets link.

Once the session has been split, it is possible to resume imaging to each separate target by clicking Resume button in each target’s Imaging Session.

The resumed imaging session will skip all sectors imaged to the target within the previous session.

This way one can complete imaging to all targets at different times, as they become available.

NB Please note that if a target becomes unavailable during imaging, the process will automatically stop running, and you can try to either resume imaging to all targets, or split imaging sessions should it be necessary.

The post Splitting an imaging session to separate targets appeared first on Official Atola Technology Blog.

It is possible to transfer all or some of the cases stored in one Insight’s case management system to another one. The only requirement is that both computers have the same version of Insight installed.

Whenever cases need to be transferred from one computer to another one, start by exporting the cases.

1. Go to Cases category of the top level menu and click Export.

2. In the Export Cases window select folder where the cases should be stored, then select the cases you would like to be exported and click Save button.
3. The cases are now saved as a package in a zip file (with the default name Cases.Package.zip), which can later be copied to a different computer.

NB Whenever a case is exported, a record about it is added to the case’s history.

Importing cases

To import cases from a zip file into Insight on a different computer.

1. Click Import in Cases category of the top menu of Insight.
2. Click Browse icon and select path and name of the zip file.

3. Select some or all of the cases in the table and click Import button.

Please note that if there is a match between existing case numbers and the imported ones, Insight will prompt you to either cancel the import or save the case that causes the conflict as a copy.

The post Exporting and importing cases from one computer to another appeared first on Official Atola Technology Blog.

We are pleased to inform you that we have a bunch of Thunderbolt extension modules in stock that are ready to be shipped. The first extension modules are already on their way to the early birds who have placed their orders before they became available.

Thunderbolt extension module enables forensically sound imaging and other operations on all generations of MacBooks.

Supported interfaces and functionality

Thunderbolt extension enables Insight to work on all MacBooks with the following interfaces:

• FireWire
• Thunderbolt 2
• Thunderbolt 3

With the help of Thunderbolt extension module you can perform such operations:

• imaging
• hash calculation
• hash verification
• comparing
• media scan
• file recovery

2016 and 2017 generations of MacBooks have non-extractable SSD drives, so the only way to handle such drives is by booting the MacBook in Target mode. In fact, with Insight’s Thunderbolt extension you can operate on all Macbooks the same way, hard drive extraction is no longer necessary.

Where to buy

To place an order, contact Atola Technology directly or a distributor near you:

http://atola.com/wheretobuy/

Please contact our Atola Technology sales to receive more specific information:

• Call us: +1 888 540-2010, +1 416 833-3501  10am – 6pm ET
• Or email us: http://atola.com/support/inquiry.html?type=1

The post Thunderbolt extensions ready for shipping! appeared first on Official Atola Technology Blog.

We have just returned from Techno Security & Digital Forensics Conference, which took place on September 18-20 in San Antonio, Texas. Here are some of the questions asked at this event, which we would like to share with you, along with our answers to them. Should you have further queries, please don’t hesitate to write a comment below or send us a message here.

Question: Is there a reason why segmented hashing should be used to calculate hash of drives that are not damaged?

Answer: Yes, segmented hash allows you to verify evidence on the drive and its image even if either of them becomes damaged at some point in the future. With regular hashes you will get a hash mismatch upon verification and the entire image becomes useless. But with segmented hashing only a single hash value will become invalid while the rest of the image can still be validated.

Question: Is it possible to adjust imaging settings during imaging?

Answer: Yes, it is possible to do that by clicking Imaging settings link in the upper part of Insight’s window.

It is possible to adjust the following settings:

• post-hash target device(s)
• reverse direction on individual passes
• disable read look-ahead
• maximum number of consecutive power cycles
• actions on consecutive read errors
• compare source and target after imaging
• power down source device when finished
• read SMART information before the beginning and after the end of imaging
• head selection
• enable email status notification

However, certain options cannot be adjusted on the fly (e.g. number of passes and some of their preferences, hash method and type, filling errors with patterns etc.). If you need to make changes to these settings, pause the current session and click Add new session link located under the paused session, and adjust settings before clicking Start Imaging button.

Question: Can Insight achieve top imaging speeds when saving an image file to a location on a local network?

Answer: Insight’s 10Gbit Ethernet extension module allows imaging drives to a local network at top speeds as well as performing file recovery, compare, write from file.

However, a few minor adjustments need to be made:

1. Update the 10GbE driver on PC workstation to the latest version
2. Link 10GbE Ethernet extension module and 10GbE PC workstation LAN adapter with a Cat6 ethernet cable
3. Open Windows Network and Sharing Center
4. Click Change adapter settings link
5. Locate 10GbE Ethernet card and open its Properties by clicking with the right mouse button
6. Click Configure button
7. Select Advanced tab
8. Change Jumbo Packet value to 9014

Note that PC motherboard quality can have an impact on the resulting network performance and ensure that the PC drive is able to read/write at speeds above 300 MB/s.

Question: If an imaging session is paused, and then a new imaging session with the same source and target devices is created, will Insight image all sectors in range all over again?

Answer: No, Insight will only image the sectors that remained unimaged after the previous session.

e.g. if Insight has already imaged sectors 0 – 5,000,000 before imaging was paused, it will image sectors 5,000,001 onwards when imaging from the same source to the same target is started. However, if a different target device is connected, imaging will start from sector 0.

The post Q&A during Techno Security and Digital Forensics Conference in San Antonio, Texas appeared first on Official Atola Technology Blog.

Being able to evaluate the drive’s state before it has exhausted its resources can make all the difference between a case won or a case lost in a court of law.

SMART table is a valuable source of information about a hard drive’s health. SMART (Self-Monitoring, Analysis and Reporting Technology) provides stats of a drive’s operation, thus helping predict its future failure. Making a definitive conclusion based on the indices in SMART table is not easy: not all parameters are critical, it is usually a combination of bad values of a few parameters that point to a trouble, time factor plays a role too (how fast has the state of the drive been deteriorating).

To view SMART table of a drive:

1. Go to View SMART subcategory of Diagnostics category of the left-side menu
2. Click Read SMART button

SMART table attributes may differ depending on the drive manufacturer. The most critical attributes are:

• Reallocated sectors count
• Current pending sector count
• Uncorrectable sector count

When RAW value of any of these attributes is greater than zero, Insight will highlight it in yellow.

The worse the values, especially in these critical attributes, the more carefully the drive needs to be treated.

To keep track of the changes occurring to the attributes of the SMART table, Insight records SMART table indices prior and after each imaging session.

To open both SMART tables for side-by-side comparison:

1. Go to Imaging Results
2. In SMART data line click View link.

By comparing the two tables, operator can evaluate whether the health of a drive has been deteriorating throughout the imaging session and thus assess how quickly its health has been getting worse.

Whenever you need to evaluate how the state of the drive has been changing long-term, you can go to previous imaging sessions and look up SMART table. Insight will store this information in its case management system.

The post Tracking a drive’s SMART table status before and after imaging appeared first on Official Atola Technology Blog.

Ever since Atola Technology has shifted its focus from data recovery to forensic market, we have been researching our clients’ needs and developed Atola Insight Forensic in close cooperation with law enforcement agencies and forensic experts to meet their demand in speedy evidence acquisition tool for both good and damaged media.

We find it very rewarding that our systems have been indispensable in a huge number of investigations and appreciate the feedback from our customers that we have been receiving throughout the years.

Among the forensic experts who have been successfully solving cases with the help of our devices are Derek Frawley and John Farrugia from the Police of Ontario, Canada.

In June 2017 Derek and John were invited to speak at the Techno Security and Digital Forensics Conference. In the presentation, they shared their experience in streamlined child exploitation investigations and dedicated 6 slides to Atola Insight Forensic and its functionality that makes this device essential to their investigation process.

We are deeply touched by the fact that our expertise in data recovery makes an impact in investigations as important to children, families and communities as these, and we would like to share this presentation with you.

Streamlined Child Exploitation Investigations by D. Frawley & J. Farrugia

The post Successful use of Insight in investigations: Our clients’ presentation appeared first on Official Atola Technology Blog.

When you work with a damaged device, and imaging can only be performed in multiple passes due to bad sectors or physically damaged areas or heads, it is impossible to calculate linear hash of the drive. This can become a serious challenge if you need to prove evidence integrity in the court of law. And it is for such cases that Atola Insight Forensic has Segmented hashing functionality.

According to the recommended workflow, run Automatic checkup of the evidence drive.

If the drive has hardware or bad sector issues, it is likely that imaging will not be completed within one pass, and you can calculate the hash for such drive only with Segmented hashing.

Furthermore, we recommend that you calculate hash and image the drive simultaneously: this way data on the drive is only read once for both processes and you avoid further deterioration of the drive:

1. Press on Create new session link in Imaging category of the left-side menu and select the target drive
2. Click on Show settings link in Preset line
3. Tick the box next to Hash source during imaging
4. Select Segmented option in Hash method drop-down menu
5. Click Start imaging button

Please note that Segmented hashing option disables imaging in reverse direction on all passes.

Just as imaging narrows down the problematic areas and reads the data within these areas on each subsequent pass, Segmented hash is calculated for the successfully read spans of data.

Once imaging is completed, you can find the set of hashes calculated in the course of imaging. Go to the imaging report

In the excel file with segmented hashes you can find the hash calculated for all the 4 GB segments of the drive space, as configured in the settings. Some of the segments are smaller due to an encountered bad sector, which, in accordance with the multi-pass imaging algorithm forced Insight to jump by a preconfigured number of sectors. Lower in the table you can find hash calculated for smaller segments within the jump area within the first three passes illustrating the concept:

This way segmented hashing allows obtaining a hash even for a severely damaged drive.

Please follow this link to learn how you can easily verify segmented hashes:
http://atola.com/products/insight/manual/Verify-Image-with-Segmented-Hashing.html

__

In November 2016 Atola Technology introduced a new hashing method called Segmented hashing.

Atola’s open-source tool Seghash, which was written in Go and has been released under MIT license, works on Windows, Linux and macOS. Atola Technology has published the tool on its Github page and encouraged the adoption of the segmented hashing algorithm by software vendors who want to provide their users with a superior hashing option.

The post Calculating segmented hash of a damaged drive appeared first on Official Atola Technology Blog.

On December 5 Atola Technology releases Atola Insight Forensic 4.10.

The key feature is the search of artifacts capability while imaging a source evidence media. It allows to search the source drive for credit cards, emails, URLs, IPs, GPS coordinates, phone numbers, keywords etc. in the course of imaging. This feature will help forensic specialists expedite investigation in urgent cases or when dealing with a damaged drive that takes hours to image.

The full list of Atola Insight Forensic 4.10 changes can be found here: Atola Insight Forensic Changelog.

Imaging settings now have a new Artifacts tab where different types of artifacts can be selected and lists of keywords or regular expressions can be uploaded.

For each of the artifacts, we have not simply applied well-known algorithms (e.g. Luhn formula used to validate credit card numbers). We have developed our own smart filters to eliminate false results (e.g. if there are two slashes near the number that has preliminarily been identified as a credit card number, that will eliminate it from the search results, as it is likely to be a part of a URL).

We have added a new Artifacts tab in the bottom part of Insight’s imaging window: the numbers of the found artifacts and the corresponding diagram change on the go.

The list of found artifacts is opened by a click on any of the categories or the diagram itself.

In the table, each artifact’s Value is shown in the context (including 20 bytes before and 20 bytes after the artifact), the LBA and the offset are also displayed in the table to help locate the artifact.

There are many options to help find, sort, filter and view the artifacts: it is possible to view one or a few categories of artifacts in one list, use the search bar to find a specific value, filter results for unique values by clicking the Show only unique artifacts link.

The latter option is quite valuable as it helps identify the values most frequently occurring on the drive. It often accelerates the whole process of specific artifact search.

For more information about the Artifacts feature please read our next week’s blog post or follow this link to our manual:
http://atola.com/products/insight/manual

Where to buy

If you still do not have an Atola Insight Forensic and would like to place an order, this can be done directly via Atola Technology, or from a distributor near you:

http://atola.com/wheretobuy/

Please contact our Atola Technology sales to receive more specific information:

• Call us: +1 888 540-2010, +1 416 833-3501  10am – 6pm ET
• Or email us: http://atola.com/support/inquiry.html?type=1

P.S. Dear customers, we appreciate your feedback and will take it into account when making changes to the product. Therefore, please feel free to write your thoughts or ideas as comments below.

The post Atola Insight Forensic 4.10 – Search of forensic artifacts in the course of imaging appeared first on Official Atola Technology Blog.

Imaging is a time-consuming part of the evidence acquisition process, especially when dealing with damaged drives.

Even though Atola Insight Forensic is the fastest forensic imaging tool in the world (there is literally no penalty on a drive speed when you image it with Insight!), we want to help expedite forensic process even further. That is why our team of engineers has developed the artifact search feature, which allows analysis of data from an evidence device during imaging.

Artifacts settings

1. Go to Imaging category of the left-side menu
2. Click Create new session link and select the target device
3. In Preset line click Show settings link
4. Open the Artifacts tab.

In this tab it is possible to view, select or deselect the artifacts you want to be searched in the course of imaging.

For each of these artifacts we have not only applied well-known algorithms including the Luhn formula used to validate credit card numbers, but also applied our own smart filters to eliminate false results (e.g. if there are two slashes near the number that has preliminarily been identified as a credit card number, that will eliminate it from the search results, as it is likely to be a part of a URL).

Keywords and regular expressions can be added to the search parameters in a txt file with one artifact per line. Click the View link next to Keywords category in Artifacts tab before imaging and make sure the keywords are displayed correctly. Keyword encoding can be adjusted to Unicode, Unicode (UTF-8), Unicode (Big-Endian) or US-ASCII.

A few of the artifacts are selected by default, namely: GPS, MAC, Phone numbers, URL. You can adjust these default settings and click Save settings button. This will affect all future imaging sessions (including those on new source drives) unless you re-adjust the settings or restore the default settings by clicking the corresponding link. The paths to the files with keywords and regular expressions will also remain saved, although should any changes by made to the txt files in the saved directory, the changes will be uploaded at the start of each imaging session.

NB. It is advisable that no more than 4 artifacts are selected at a time, otherwise imaging will slow down considerably. Also, keywords consisting of less than 4 symbols or regular expressions consisting of less than 6 symbols; large number of keywords (more than 2000) or regular expressions (more than 10) may also slow down imaging process. This is due to the large number of results such search parameters are capable of producing.

Once you have ticked the boxes next to the artifacts you would like to be searched for, click Start Imaging button.

Browsing through the artifacts in the course of imaging

Once imaging has begun, go to the Artifacts tab in the bottom part of Insight window and watch the selected artifacts being found: the numbers of artifacts and the corresponding diagram change on the go.

To see the artifacts in a list, press on any of the categories or the diagram.

In the table, each artifact is assigned an Id number, each found Value is shown in the context (including 20 bytes before and 20 bytes after the artifact in grey color), the LBA and the offset are also displayed in the table to help locate the artifact.

There are many options to help find, sort, filter and view the artifacts: it is possible to view one or a few categories of artifacts in one list, use the Search bar to find a specific value (search examples are provided in the bottom right corner of the window), filter results for unique values by clicking the Show unique artifacts link.

The latter option is quite valuable as it helps identify the values most frequently occurring on the drive: to sort the results click Count in the table header.

To promptly find the sector where an artifact is located, you can double click the artifact you would like to examine more thoroughly.

Exporting artifacts

Export to CSV button is disabled during imaging. You can wait until imaging is completed or pause it, make an export and restart imaging, should it be necessary to start analyzing the current artifact search output with an external tool:

1. Pause imaging.
2. In the Imaging results page click on Artifacts link.
3. In the Artifacts page you can select the artifacts you would like to be exported (e.g. one or multiple artifact categories, unique artifacts or only those fitting certain search criteria), and then click Export to CSV file button.
4. Select the path for the file and click Export
5. Once the export is completed (which normally takes no longer than a few seconds), restart imaging.

There is Export artifact link now in the Imaging category of Insight’s menu. If the source drive was imaged in multiple sessions, and artifact lists were created during different imaging sessions, by clicking this link you can download a merged list of artifacts from multiple imaging sessions.

The post Artifacts: Image & analyze on the fly appeared first on Official Atola Technology Blog.

For more information please read about the suggested workflow and hashing during imaging.

The post Evidence acquisition workflow in 5 steps appeared first on Official Atola Technology Blog.

As we travel to exhibit at forensic events worldwide, we usually bring some of the fastest SSDs (usually Samsung 850 Pro) with us to show the speed at which they can be imaged with Atola Insight Forensic (on these drives, it constitutes around 500 MB/s).

At the same time, we feel that in this blog we have missed the opportunity to demonstrate exactly how fast Insight can image different types of hard drives, solid-state drives, USB flash memory, etc.

We test our units on a wide range of storage devices. This time we imaged a few of them and cross-checked the speed with userbenchmark.com, where you can find detailed info on the minimum, average and maximum read and write speed of almost every data storage device in the market.

NB. Imaging speed is limited by the speed of the slowest of the devices participating in the imaging session. Therefore, the slowest of the two speeds (either the read speed of the source or the write speed of the target) will define the speed at which imaging process is running.

Samsung 850 Pro 256GB

We begin with the Samsung 850 Pro SSDs mentioned above. These two drives are not damaged but are rather worn out, as we have been demonstrating Insight’s imaging speed on them at every exhibition for a few years now. Insight images from one such SSD to another at 501 MB/s (therefore it is the write speed of the target drive that defines the imaging speed in this case).

At userbenchmark.com this drive’s maximum write speed in sequential mode (sectors read and written to in sequential order) is 502 MB/s.

Samsung 850 Pro 128GB

Next, we take the 128 GB version of the same SSD drive, and Insight images it at 490 MB/s.

The maximum write rate (we image to an identical SSD) claimed at userbenchmark.com (based on over 6 thousand samples) is 490 MB/s, the same rate as that achieved by Insight.

Toshiba X300 4TB

When Insight images a 4TB Toshiba X300 (an HDD with SATA interface), it achieves the speed of 195 MB/s.

How does this speed compare to the one at userbenchmark.com? The website quotes 182 MB/s of max read speed. Insight’s speed substantially exceeded the benchmark speed based on 992 samples!

Western Digital’s Blue 250 GB (2008)

Insight’s speed of imaging a Western Digital’s Blue 250 GB constituted 115 MB/s.

At userbenchmark.com the same drive’s max read speed is 115 MB/s. Again Insight achieved the top speed based on over 3000 samples.

Western Digital WD7500AYPS 750GB

Insight was able to reach 77 Mb/s when reading WD7500AYPS 750GB drive.

The same drive at userbenchmark.com achieved the maximum read speed of 73.7 MB/s. Again Insight exceeds this index.

HGST HTS41010A9E680 1TB

When imaging this HGST 1TB SAS hard drive, Insight was able to achieve 111 MB/s.

And it is a much higher speed than that of userbenchmark.com (99.5 MB/s max read speed).

Corsair Voyager 3.0 64GB

Next, we imaged Corsair Voyager 3.0 64GB USB, and Insight reached an overall speed of 207 MB/s.

The max read speed achieved by the contributors of userbenchmark.com constituted 215 MB/s. Insight did below the max speed but substantially above the average.

Speed has always been the cornerstone of our development efforts. And we are pleased to confirm that Insight does exceptionally well when imaging most data storage devices.

Please note that here we imaged devices that were in overall good health. Imaging may be considerably slower when dealing with a damaged drive, and the speed heavily depends on the type and degree of such damage.

Here are links to the userbenchmark.com pages with the devices mentioned in this blog for your reference:

Samsung 850 Pro 256GB http://ssd.userbenchmark.com/Samsung-850-Pro-256GB/Rating/2385

Samsung 850 Pro 128GB http://ssd.userbenchmark.com/Samsung-850-Pro-128GB/Rating/3483

Toshiba X300 4TB http://hdd.userbenchmark.com/Toshiba-X300-4TB/Rating/3592

WD Blue WD2500AAKS 250GB http://hdd.userbenchmark.com/SpeedTest/2143/WDC-WD2500AAKS-00L6A0

WD WD7500AYPS-01ZKB0 750GB http://hdd.userbenchmark.com/SpeedTest/7309/WDC-WD7500AYPS-01ZKB0

HGST Travelstar 5K1000 2.5″ 1TB http://hdd.userbenchmark.com/SpeedTest/72/HGST-HTS541010A9E680

Corsair Voyager GT 3.0 64GB http://usb.userbenchmark.com/SpeedTest/5886/Corsair-Voyager-GT-30

The post The speed of imaging with Atola Insight Forensic appeared first on Official Atola Technology Blog.

Event season 2018 has already begun! With this post we want to start the list of the most prominent worldwide events on digital forensics. If you want to keep up to date with the exhibitions and conferences organized around the globe, save this link and check this page later: we are going to update the list as we receive info on new events and get the dates of the already planned ones confirmed.

The events, at which Atola Technology will be exhibiting, are marked with asterisk (*).

last updated March 1, 2018

NB The registration fees in this table are indicative. Each conference has a range of fees based on the occupation, the country of origin or the role of each participant. Therefore we mention only the basic rate which does not include discounts or special offers. Please check the conference websites to learn more about the applicable registration rates.

The post Top forensic conferences 2018-2019 appeared first on Official Atola Technology Blog.

We are very pleased to announce the official launch of our new fantastic product – Atola Taskforce.

What is Atola TaskForce?

It all starts with a routine problem. The problem that people face every day spending more and more effort to solve. During our conferences and private communications with customers throughout the last 3 years, we found the most critical issue is:

Evidence acquisition time that has been increasing every year

Atola TaskForce is designed to solve this challenge.

TaskForce enables the simultaneous imaging of 8 or even more drives reaching the total performance of 15 TB per hour. This new power hides in hardware that has the compact dimensions of a modern gaming console.

You and your peers can manage the system via a browser from any device with any OS. It may be your desktop PC, laptop, tablet, smartphone or the built-in TaskForce touch screen.

We are sure you will be blown away by the capabilities of the system:

• 8+ parallel imaging sessions
• 18 ports with embedded and switchable write protection
• Damaged drive support
• Two 10Gb Ethernet ports for faster imaging
• Standalone mode
• Simultaneous multi-user access via web-based UI
• Gorgeous 12-inch touch screen with 2736 x 1824 resolution

Find out more about Atola TaskForce at our renewed website.

We hope you are as excited as we are. Let’s get this new imaging revolution started!

The post We are launching Atola TaskForce. The revolution is here appeared first on Atola Blog.

So how exactly does Atola TaskForce perform 8 or more imaging sessions or other long-running tasks (hashing, wiping, etc.)?

Multiple processes can run in parallel thanks to TaskForce’s high-capacity hardware.

TaskForce has a 8-thread Xeon CPU. Each of the threads backs imaging at the speed of 600 MB/sec (or faster on SAS and extension ports). Should a drive’s native speed be lower than that, the respective thread’s capacity is freed up for more workload. It means that you can launch more than 8 tasks at a time: 10, 12 or 15 with no negative affect on individual performance.

For instance, if one of the eight drives engaged in parallel imaging sessions is slow, e.g. an IDE drive with 100 MB/sec native speed, the 9th session will be using the remaining 500 MB/sec capacity of the thread backing the imaging of these drives.

The same is true not only for imaging sessions, but also hashing, wiping, and any other long-running tasks. Please note that hashing is the most capacity-consuming process, and when multiple hashing algorithms are used, the speed may somewhat slow down, though not substantially.

Imaging sessions can be launched one by one, without any waiting period.

Although we claim 15 TB/hour overall performance, if you use the whole capacity of TaskForce’s 8-thread Xeon CPU, you will be able to achieve greater speeds.

Please note that in order to achieve top performance while imaging, you need to either image to a high-speed SSD or to your 10Gb Ethernet network server.

The post Running 8 or more tasks on TaskForce appeared first on Atola Blog.

Atola TaskForce has three connectivity options:

1. 10Gb Ethernet network
2. Standalone mode
3. WiFi access point

10Gb Ethernet network

Atola TaskForce is equipped with two 10Gb Ethernet ports. Whenever the system is connected to a local network via one of its Ethernet ports, an IP address will be displayed on the IP screen on the front panel of the system.

IP address of Atola TaskForce

If the system is connected via both Ethernet ports, two IP addresses will be displayed on the screen. These IP addresses are assigned to TaskForce by your DHCP server.

Multi-user access

With the help of these IP addresses, TaskForce can be operated by multiple users from their workstations or mobile devices:

• enter either of the IP addresses as shown on the IP screen in Chrome browser on another device within the same local network.

Enter IP address in Chrome browser

Through Chrome browser one can remotely track and manage tasks, power devices on and off, open, edit and print cases etc.

Types of devices that can be used to access TaskForce simultaneously include:

• Desktop PC
• Laptop
• Tablet
• Smartphone
• Built-in TaskForce touch screen

TaskForce software can be open in Chrome browser within any OS.

This functionality enables a group of users to work on different assignments using the same tool. This helps utilize TaskForce’s multitasking capabilities to the maximum and track operation progress remotely. The number of users accessing TaskForce simultaneously is unlimited

Standalone mode

TaskForce is equipped with highly responsive HD screen (see Hardware specs), which allows the system’s use in standalone mode.

Whenever the system is not connected to a network via its 10Gb Ethernet ports, Standalone mode status will be displayed on the IP screen.

In this mode, you can image data from multiple source drives to target drives in parallel. Thanks to its compact size TaskForce can be easily used in the field.

Compact and lightweight TaskForce

Wi-Fi access point

The third way to access TaskForce’s user interface is via built-in Wi-Fi 802.11n 150 Mb/s adapter. The adapter is disabled by default. To enable it, follow these steps:

1. Go to Menu in top right corner of TaskForce web page
2. Click Settings
3. Enable Wi-Fi Hotspot. An IP address will appear underneath Wi-Fi Hotspot category.
4. Click SETTINGS button

Enable Wi-Fi Hotspot

5. Enable Wi-Fi Hotspot
6. Set SSID and Password. To make the network invisible to other devices, check the Hidden mode box. Click SAVE button.
7. Use these details to connect to the Hotspot from another device.

Adjust Wi-Fi settings

8. Enter the IP address (under Wi-Fi Hotspot category in Settings window, see Step 3) in Chrome browser of the device you have connected to the Hotspot.

The vast connectivity options make TaskForce a great tool for using both in the lab and in the field.

The post Atola TaskForce’s connectivity and multi-user access appeared first on Atola Blog.

When an evidence drive lands on investigator’s table for the first time, there is always an uncertainty when it comes to the drive’s condition. A broken head or scratched surface of the media require different imaging tactics. That’s why it is strongly suggested that before imaging, each drive should first be diagnosed. 

TaskForce has Atola’s unique diagnostics module which checks all systems of the drive:

• Hard drive’s motor and electronics (PCB)
• Head stack
• Media surface
• All firmware/system areas
• Partitions and file systems

At the end the system produces a report which sums up all issues. The process will take only 2 – 5 minutes. 

To start, click Diagnostics button in the left-side menu, select the drive and then click START button at the bottom of the screen.

Starting diagnostics

First, TaskForce checks the drive’s printed circuit board. The system applies power to the device and records and analyzes spin-up current curve. This helps detect most issues with the PCB and the motor. Next, TaskForce analyzes the contents of the hard drive’s ATA registers and device identification sector.

Circuit board check

After that, the head stack is tested. Several factors are taken into consideration when diagnosing heads: media access time for each head, power consumption curves, and internal drive’s error reporting systems.

If the head stack looks good, the system performs a short media scan. The purpose of this scan is to verify if there are any bad sectors in the starting, middle and ending sectors of the drive pointing to a damage to the media surface or logical errors. 

Heads and media surface check

Next, several firmware tests are performed:

Firmware check

If TaskForce detected no issues by this point, it performs a file system checkup:

File system check

After this final stage of diagnostics, TaskForce displays the full report. Diagnostics result message box contains a short summary of all tests. It also provides estimated imaging time for this drive.

Diagnostics report

The post Diagnose a drive with Atola TaskForce appeared first on Atola Blog.

With TaskForce units already sold in 4 continents, we are delighted to launch TaskForce software 2018.1.2, which includes the Chinese version.

The Chinese version of TaskForce

The new version can be downloaded here. To switch to the Chinese language, click Menu icon in the top right corner of the TaskForce window.

This software update includes only the new language. More features will follow later this year.

The post Chinese version of TaskForce launched! appeared first on Atola Blog.

Among the first users of Atola TaskForce, there are many owners of Atola Insight Forensic systems.

Cases from Atola Insight Forensic can easily be imported into TaskForce. First, export cases from Insight’s case management system.

To import cases from Insight’s case management system,

1) click Cases in the top left corner of the TaskForce page

2) click the Import button at the bottom of the page.

Click the Import button

3) In the file selector, find the zip file that contains cases from Insight’s case management system.

Select file with cases exported from Insight

Importing will take a few minutes. Then you will be redirected to the report with the list of all imported cases.

Report of case import

Now all cases are a part of TaskForce’s case management system.

Imported cases in TaskForce’s case management system

NB Reports exported from Atola Insight Forensic system and imported to Atola TaskForce have a slightly different format: their header is contained in a box.

Case imported from Insight

The post Importing cases from Atola Insight Forensic appeared first on Atola Blog.

TaskForce automatically creates reports for every single action applied to each drive connected to it. Whether it is a source drive or a target drive, any action, be it imaging, wiping or physically switching write protection on or off, will be documented and stored in the system.

To find a case, click Cases in the top left corner, it will redirect you to the case management system.

Open case management system

Search for a specific case or device in the Search bar (by case ID, investigator’s name or device details) and sort results by any column.

Search and sort cases in the list

To open a case, click the respective line in the list.

A case page contains case details, information about the devices associated with the case (name, serial number, capacity etc.), as well as reports for all tasks applied to the device.

NB At the moment, a case may only include one device. In the future releases, we will be adding the possibility to add multiple devices in a case as well as including the same device within a number of cases.

Editing case details

To change case details, click on Edit button at the bottom of a case page.

Case page

It is possible to change the case ID, Description and Investigator. Click Save changes button when done editing.

Change case details

In upcoming software releases, we will be adding the possibility to store multiple drives under the same case number. We will also be adding the possibility to upload pictures (photos of the device, scanned reports and documents related to the drive etc.) to be stored in a case.

The post Finding and editing cases appeared first on Atola Blog.

Atola TaskForce’s imaging functionality provides many adjustable settings to help forensic examiners follow the guidelines set by their organizations as well as common-sense evidence handling routines.

When you need to create two images of a source drive and verify that both images are identical to the source drive, you will need to calculate the hashes of both targets after imaging. To optimize the process, post-hashing of both target devices is easily configured in imaging settings:

1) Click Image button in the left-side menu

2) Select Source and Target devices, which will redirect you to the page with the summary of current imaging settings. In the default settings, hashing of source drive during imaging is enabled.

3) Click the Change button to adjust the settings.

Change default imaging settings

4) in the Hashes tab of the settings, enable Post-hash target devices option.

5) Click Start button to proceed with imaging

Select post-hashing of targets

Hashing of source drive during imaging is a preferred option because it only requires the data on the evidence drive to be read once, for both imaging and hash calculation. This ensures both a forensically sound process and minimal impact to potentially unstable media. Hashing during imaging does not slow down imaging process.

Imaging progress

Once imaging is completed, post-hashing begins immediately on both target devices:

Post-hashing in progress

In the end, TaskForce produces a report that documents hashes of both source and target devices:

Imaging report with source and target hashes

The post Imaging a drive to two targets with post-hashing appeared first on Atola Blog.