Column Content
Creation Date The IS0 8601 UTC date/time string for the creation date of this entry.
This field is empty if the creation date is unavailable.
Accessed Date The IS0 8601 UTC date/time string for the accessed date of this entry.
This field is empty if the accessed date is unavailable.
Modified Date The IS0 8601 UTC date/time string for the modified date of this entry.
This field is empty if the modified date is unavailable.
Written Date The IS0 8601 UTC date/time string for the written date of this entry.
This field is empty if the written date is unavailable.
MD5 Hash The MD5 Hash of the entry. This field is empty for directories. It is
also empty if no MD5 hash was calculated, no MD5 hash was
configured, or the entry did not match the rules for acquisition.
SHA1 Hash The SHA1 Hash of the entry. This field is empty for directories. It is
also empty if no SHA1 hash was calculated, no SHA1 hash was
configured, or the entry did not match the rules for acquisition.
File Status OK if there were no problems reading file data/metadata.
ERRORS if there were errors reading file data and/or metadata.
This field is empty for directories.
Matched Rules “Y”if the file matched the acquisition’s rules for inclusion. For TD4,
this will always show a match as file/folder down selection/filtering is
not supported.
4.11 Hashing
Forensic practitioners may need to calculate the hash values, or fingerprints, for a
source drive without making a copy of the drive. The Hash function can generate
MD5, SHA-1, and SHA-256 hash values for a source drive, as determined by the
Hashes system setting.
1. Follow the steps listed in “Connecting drives” on page 27 to connect the desired
source drive.
Note: Since TD4 only allows one source drive to be used for any job,
connect only the desired hash source drive and ensure no other source
drives are attached. If any other source drives are attached, a warning will
be provided in the Hash function tile and the Start button will be inactive
(grayed out).
2. Expand the Hash function tile on the home screen. A summary of the pertinent
job settings will be shown along with any applicable warning messages. Verify
the settings, resolve any blocking warnings, and then tap the Start button. If
none of the settings are set to Prompt and there are no other job configuration
issues that need to be resolved, the job will start, and the job status screen will be
displayed.
Chapter 4 Using TD4
66
OpenText™ Tableau™ Forensic TD4 Duplicator
ISTD230100-UGD-EN-1
To Next Page
Loading...
