off the screen. The size of each file is shown in parentheses at the end of the
filename.
To open individual directories, double-tap the directory name or single-tap the
directory to select, and then tap the open directory icon . Tap the up directory icon
to back out of a directory.
For destination and accessory drives, new directories can be created and directories/
files can be deleted. To create a new directory, simply tap the create directory icon
and enter the new directory name. To delete a directory or file, single-tap the
directory or file to select, and then tap the delete icon .
4.8 Case information
Case information is a key part of any digital investigation. When entered on TD4,
case information will be displayed in key places throughout the user interface
during job execution and captured in forensic logs. This allows easy correlation of
key acquisition artifacts with specific cases throughout an investigation.
To enter case information, expand the Case Info function tile from the home screen.
Tap each of the fields to enter the desired text. Note that text entry fields on TD4 are
live. That means what you type will automatically be saved when you navigate
away from the text entry field, with no need to explicitly save the new entry.
The following case information can be entered on TD4: Examiner Name, Case ID,
and Case Notes.
At the bottom of the Case Info function tile is a selection box that will drive a prompt
to enter Job Notes at the start of each job. When this box is checked, an advanced
settings screen will appear before the start of each job that allows Job Notes to be
entered. This allows for specific information about a particular piece of digital
evidence to be entered and captured in the forensic log for each job.
4.9 Duplicating
TD4 will duplicate one source drive to up to five destination drives. Only one source
may be connected at a time and thus only one forensic job can be run at a time. For a
given job, the destinations can be a mix of cloned and imaged copies.
Note: This section is focused on whole-disk duplication operations, also
known as physical imaging. See “Logical imaging” on page 60 for details on
that alternative acquisition method.
Before starting any forensic job, TD4 automatically checks for preconditions. These
preconditions are related to specific job setup parameters that could impact the
ability of TD4 to execute the desired job. Some preconditions produce warnings that
appear in the expanded function tile on the home screen. Some of those warnings
require changes before being able to start the job, while others are informational and
do not prevent the job from starting. For any precondition checks that may require
4.8. Case information
ISTD230100-UGD-EN-1
User Guide
53
To Next Page
Loading...
