Atola Taskforce

Atola TaskForce is a high-performance forensic imager capable of working with both good and damaged media. It supports SAS, SATA, USB and IDE drives via 18 ports, and other storage devices via Thunderbolt, Apple PCIe, and M.2 SSD extension modules. TaskForce is equipped with RAID autodetection module allowing it to reassemble and image RAID arrays with unknown configurations. The forensic imager consists of a hardware unit and software accessible in Google Chrome browser. It can be operated either in standalone mode or by multiple users within the same local network.

TaskForce Web API enables automation of forensic imaging and subsequent start of evidence analysis with software like Magnet AXIOM, X-Ways, Autopsy, etc. Atola stands behind its product. If the hardware unit malfunctions, it’s covered by Lifetime warranty for as long as your subscription is active.
The subscription includes 2-3 software updates in a year.

12+ simultaneous imaging sessions

Atola TaskForce combines vast multi-tasking capabilities with the fastest imaging engine in the forensic market.
Its server-class hardware enables launching and managing 12+ parallel imaging sessions.

• 15 TB/hour cumulative speed of imaging
• 2 x 10Gb Ethernet ports
• Source/target switch on all ports
• Hardware write protection in Source mode on all ports
• Imaging to up to 5 targets
• Express mode, in which imaging sessions start the moment a device is connected
• Automation via Web API
• Physical imaging to E01, AFF4 and RAW files
• Logical imaging to L01 file

 

RAID configuration autodetection and imaging

TaskForce’s fine-tuned RAID autodetection algorithms allow reassembling RAID arrays with an unknown configuration:

• RAID identification by data parcing on connected drives and/or image files
• RAID types: RAID 0, 1, 5, 10 and JBOD
• File systems: NTFS, ext4/3/2, XFS, exFAT, HFS/HFS+, FAT32/16
• Instant identification of mdadm-created RAID
• One-click application of a suggested configuration
• Partition preview
• Rebuild of RAID with a missing or damaged device (for certain types of redundancy-enabled RAID)
• Max number of auto-checked RAID configurations: 100,000,000

A RAID array can be imaged in its entirety or by individual partitions.

Damaged drive support

Physically damaged hard drives and problematic solid-state drives require a complex imaging approach. TaskForce forensic imager is designed to achieve the best results getting as much data as possible. It includes the following features:

• Imaging data from good heads only
• Imaging freezing drives
• Imaging drives with surface scratches and firmware issues
• In-depth drive diagnostics
• Pause/resume an imaging sessions, optimizing the settings to retrieve more data
• Current sensor on all SATA, SAS/SATA, IDE ports
• Automatic overcurrent and short-circuit protection

TaskForce hardware is equipped with full circuit protection to prevent a malfunctioning storage device connected to the unit causing damage to the system or to itself.

Multi-user access from any device

TaskForce user interface is highly intuitive, task-oriented. It is designed to facilitate work with evidence for investigators with different levels of technical proficiency.
UI features are:

• Operating the unit via Chrome browser
• Simultaneous operation by multiple users
• Launching any operation within a couple of clicks or taps
• Highly intuitive task-oriented user interface

 

Web API for Workflow Automation

Automation of the digital forensic process becomes not just relevant but increasingly pressing to examiners dealing with ever growing volumes of data in forensic cases.

To enable TaskForce users to integrate their forensic disk imaging system into their automated workflow, we provide the ability to launch, track and stop operations via Web API.

API (application programming interface) helps external software to communicate with TaskForce. It prescribes the type of commands that can be sent to TaskForce, describes the behavior TaskForce should demonstrate and the type of responses it should send back to the automation software.

TaskForce API is based on HTTP GET requests and JSON-encoded responses. See API specification.

Part No:
AP-ATOLA-TF

Extension Modules

TaskForce hardware unit was designed to allow expanding its compatibility with drive interfaces with the help of hardware add-ons. The unit is equipped with PCI Express port on its back panel, which is referred to as Extension port. It is used to plug Atola hardware extension modules supported by Atola TaskForce software.

Warranty for Extensions = 1 Year from date of purchase.
Currently supported extension modules are:

Currently supported extension modules are:

• Thunderbolt
• Apple PCIe SSD
• M.2 NVMe/PCIe/SATA SSD

M.2 SSD extension for NVMe/SATA/PCIe

Only M key interface drives are supported with this extension. Here are the differences in M.2 NVMe, M.2 SATA and M.2 PCIe support:

Features	M.2 NVMe	M.2 SATA	M.2 PCIe
All Insight operations
Drive hotplug
Power management

 
Part No:
AP-ATOLA-M.2

Apple PCIe SSD extension

This extension can process PCIe SSDs with custom proprietary M.2 interface found in Apple laptops:

• MacBook Pro, Late 2013 – 2015
• MacBook Air, 2013 – 2015

The following TaskForce operations and features are supported for the Apple drives:

• Imaging
• Hash calculation
• Damaged drive support
• Write protection

 
Part No:
AP-ATOLA-APPLEPCIe

Thunderbolt extension

Thunderbolt extension enables TaskForce to work on MacBooks with the following interfaces:

• FireWire
• Thunderbolt 2
• Thunderbolt 3, 2016 – 2017 models

No SSD removal is necessary, the extension allows connecting TaskForce directly to a MacBook.

TaskForce supports the following operations and features on MacBooks when connected through Thunderbolt extension:

• Imaging
• Hash calculation
• Damaged drive support
• Write protection

 
Part No:
AP-ATOLA-TBOLT