warning message will be provided in the top portion of the Contents section. Such
sector limitations are also identified with the icon attached to the drive tiles on
the home screen.
The Jobs section of the Drive Details screen provides information about jobs that
have been performed with that drive. The Jobs count indicates the number of all
forensic jobs done using that drive, and it includes the following operations:
Duplications, Logical Images, Hashes, Verifications, Reconfigures, Blank Checks,
Restores, and Remove Sector Limitations. The Completed Acquisitions count
indicates the number of fully completed, successful acquisition type jobs, namely
Duplications and Logical Images. If all the jobs for a given drive have the same Case
ID, that Case ID is shown in this section as well. If there are multiple Case IDs
associated with a given drive, “Multiple” will be shown in the Case ID field. The
View button in the bottom right of the Jobs section will display a filtered Job History
list showing only the jobs associated with that specific drive.
At the bottom right of any Drive Details screen is the Eject button. Simply tap the
Eject button and respond to the prompt to eject a drive from the system. Ejecting a
drive removes it from the system software in a safe manner and is recommended
before unplugging any attached media from a powered TD4 and before powering
down TD4 with drives attached. For destination and accessory drives in particular
(since they are read/write), failure to eject a drive prior to removal from the system
could corrupt the drive filesystem, which could result in loss of previously captured
evidence/data. Note that ejection of media being used in a job will not be allowed
until the job is complete.
In addition to quiescing the drive for system removal, pressing the Eject button will
issue an ATA spin down command to drives that may support it. Spinning down
rotating hard disk drives is recommended to minimize the chance of platter damage
upon physical removal of the drive from the system. Note that not all drives support
this command, and some may take longer to eject from the system due to lack of
spin down command support. But this is considered a minor inconvenience
compared to the benefit of minimizing the chance of drive damage.
Caution
It is highly recommended to eject all drives from the system prior to
physically removing them from TD4 or prior to powering down the unit.
This puts the drives in a quiescent state, which will ensure system stability
and the integrity of the data on the drives.
Also, ejection prior to removal is required for all drives attached to TD4
PCIe ports. Hot-swapping PCIe drives without ejecting them may cause
system instability and unpredictable TD4 behavior/performance.
4.6. Viewing sources and destinations
ISTD230100-UGD-EN-1
User Guide
39
To Next Page
Loading...
