changes, an advanced settings screen will appear after pressing the Start button to
allow the appropriate settings to be adjusted before starting the job.
4.9.1 Cloning
A clone, also known as a disk-to-disk duplication, makes an exact copy of the source
drive to the destination drive(s).
TD4 will automatically select clone for any destinations that have no detectable
filesystems. If any such destinations are connected, an informational message will
appear in the expanded Duplicate function tile on the home screen to indicate that
those drives will be clones.
Note: The icon indicates no detectable filesystems and will be shown next to
the clone informational message in the expanded Duplicate function tile and
on the left side of any applicable destination drive tiles. Those types of
destination drives will always become a clone of the source drive.
It is best practice to wipe destination media before duplicating to it as this can help
to identify potentially defective media and bad sectors, and it can reduce the risk of
cross-contaminating a clone duplication with stale data.
Note that, at the beginning of clone and restore jobs, TD4 prepares the destination
drive by wiping sectors 0, 1, and end-of-drive minus 1. This ensures there is no stale
partition table data on the drive, which reduces the possibility of drive detection
issues at the end of the job.
Note: Because partition table information is relative to the sector size of the
source drive, cloning to a destination drive with a different sector size is not
allowed. TD4 will detect this sector size mismatch issue and warn the user.
This condition will need to be rectified before the clone job can be started.
4.9.2 Imaging
An image, also known as disk-to-file duplication, copies the source drive to a series
of files (sometimes called segments) on the destination drive. TD4 supports EnCase
file formats Ex01 and E01 and raw file formats dd and dmg. For Ex01 and E01 output
types, compression is supported and enabled by default.
For image file outputs, the maximum segment size can be set in system settings to
any of the following: 2 GB, 4 GB, 8 GB, or Unlimited. Smaller segments create more
segment files and Unlimited creates one large file segment.
Note: Not all image file size options are available in all situations. Due to
filesystem addressing limitations, FAT32 formatted destinations have a
maximum file size of 2 GB.
If the destination drive is smaller than the source, a dd or dmg image will not fit on
the destination drive. However, if using Ex01 or E01, the source drive may fit on a
smaller drive because these formats can compress the data before writing to the
Chapter 4 Using TD4
54
OpenText™ Tableau™ Forensic TD4 Duplicator
ISTD230100-UGD-EN-1
To Next Page
Loading...
