Express Mode

To tackle cases that involves many drives faster, TaskForce 2 forensic imager is enhanced with Express mode for self-launching imaging. When the mode is activated, every imaging session starts automatically upon plugging source drives into TaskForce 2.

25 simultaneous imaging sessions

TaskForce 2 forensic imager can process up to 25 imaging sessions in Express mode on almost all of its Source ports:

  • 8 SATA
  • 8 SAS/SATA
  • 4 USB
  • 1 IDE
  • 4 NVMe M.2/U.2 PCIe 4.0

When activated, Express mode controls all source ports, leaving target ones available for other tasks.

Many evidence drives can be imaged simultaneously to E01 or RAW files located on a local server. To increase data transfer rate, TaskForce 2 is equipped with two 10Gb Ethernet ports.

25 imaging sessions in progress.

25 imaging sessions in progress.

Express mode: Automated diagnostics

We recommend that users enable autostart of diagnostics before imaging in Express mode settings. A fully-automated diagnostics module checks all drive subsystems: hard drive’s motor and electronics (PCB), head stack, media surface, all firmware/system areas, partitions, and file systems. Diagnostics provides a number of advantages:

  • information about drive state
  • encrypted, existing and lost partitions
  • estimated imaging time for good drives
  • recommendations for damaged drives

As soon as you connect multiple source devices, TaskForce 2 automatically runs diagnostics and later launches individual imaging sessions.

Alternatively, you can ensure imaging of good drives only by selecting Start imaging only if diagnostics has no issues setting.

Pausing self-launch imaging. When TaskForce forensic imager detects a damaged drive. It allows deciding whether start of imaging should be immediate or take place later, with a specific imaging approach based on the type of damage.

Express mode settings.

Express mode settings.