Announcement Date : January 1, 2002

TASK’s goal is to provide the investigator with all data in the file system. TASK merges the file system analysis tools in TCT and TCTUTILs into one package and adds support for the FAT file system, making it a data extraction tool that analyzes a large file system image and outputs specific parts of it in an easier to use format (since most people can’t manually parse the contents of a 1024-byte NTFS MFT structure).

Development continues over the following year on both TASK and Autopsy. TASK adds support for the NTFS file system, while Autopsy is upgraded to support TASK’s platform independence. This lends flexibility to the tools, allowing users to perform functions in the TASK command line that the Autopsy GUI does not allow them to perform.

The GUI remains important, however, as it allows an investigator to examine a file system image from a “file manager”-like interface, view unallocated space and data structures, make timelines of file activity, and conduct keyword searches.