EasyManua.ls Logo

OPENTEXT Tableau Forensic TD4 - Files Created During Disk-To-File Duplication

Default Icon
86 pages
Print Icon
To Next Page IconTo Next Page
To Next Page IconTo Next Page
To Previous Page IconTo Previous Page
To Previous Page IconTo Previous Page
Loading...
Icons will appear on the job status screen drive cards to provide at-a-glance
indication of things like no detectable filesystem present , HPA/DCO/AMA in
place , or the presence of Tableau encryption (locked or unlocked) .
Note: An easy way to tell which destination drives are getting which type
of Duplication job output (clone or image) is to look for the ‘no filesystem’
icon in the top-right area of the destination drive cards on the job status
screen. Seeing that icon means that drive will be made a clone of the source
drive.
4.9.4 Files created during disk-to-file duplication
When performing an image-based duplication job, TD4 creates files (sometimes
called segments) on the destination drive that contain the data copied from the
drive.
Segments are written to the destination drive according to the following convention
(Ex01 output shown as an example):
[directory_name]/
[filename].Ex01
[filename].Ex02
.
.
.
[filename].Ex99
[filename].log.html
[filename].td4_packed_log
[directory_name] is defined in the Evidence File Path Directory setting. The
default value is /td4_images/%d_%t/, where %d is the current date and %t is the
current time at the start of the Duplication job.
[filename] is defined in the Evidence File Path Filename setting. The default value
is image.
[filename].Ex01 (or .E01 or, for dd/dmg outputs, .001) is the first segment or
portion of the data copied from the source drive. All other segments have sequential
standard segment names (for example, [filename].Ex02, [filename].Ex03, and so on).
Note that, for cancelled or failed jobs, there may also be a [filename].Ex01.
partial file in the output directory.
4.9. Duplicating
ISTD230100-UGD-EN-1
User Guide
59

Table of Contents

Other manuals for OPENTEXT Tableau Forensic TD4