imaging. The existence of a DCO or AMA will be obvious (per warnings in multiple
locations), but the DCO/AMA will need to be permanently removed using the
Remove HPA/DCO/AMA utility before gaining access to all portions of the source
media.
Filesystem read errors encountered during logical imaging jobs may result in
unpredictable acquisition behavior. When they occur, such errors are indicated by a
red warning message at the top of the Logical Image progress section of the job
status screen. TD4 will skip any file that results in a read error and will attempt to
read any remaining files. The CSV output will show an error status for any files that
were not acquired. If you encounter filesystem read errors during a logical imaging
job, we recommend that you clone or physically image the drive (e01, ex01, dd,
dmg) instead of trying to do a logical image.
4.10.1 Performing a logical image
To perform a logical image:
1. Follow the steps listed in “Connecting drives” on page 27 to connect the source
and destination drives.
2. Ensure that all destination drives have at least one mountable filesystem.
Destinations that have mounted filesystems will receive an Lx01 image file
output. Destinations that have no detectable filesystems will not receive any
outputs from a Logical Image job.
Note: Each destination drive used in a Logical Image job must have a
filesystem to store the resulting acquisition output files. If any of the
attached destination drives do not have a detectable filesystem, a warning
message will appear above the Start button indicating that destinations
must have filesystems. If there is at least one destination drive with a
filesystem, the Logical Image job may still be started, but only the
destinations that have mounted filesystems will receive the output
evidence files.
3. Expand the Logical Image function tile on the home screen. A summary of the
main job settings will be shown along with any pertinent warning messages as
can be seen in the screenshot below. Verify the settings, resolve any blocking
warnings, and then tap the Start button. If none of the settings are set to prompt
and there are no other job configuration issues that need to be resolved, the job
will start, and the job status screen will be displayed.
4.10. Logical imaging
ISTD230100-UGD-EN-1
User Guide
61
To Next Page
Loading...
