OPENTEXT Tableau Forensic TD4 - 4.12 Verifying

as indicated by date/time information in the top-right corner of the drive
details screen. To see a live version of the drive details and to be able to
browse mounted filesystems, use the drive tiles on the home screen to
access the drive details screen.
4.12 Verifying
The standalone Verify function verifies the integrity of an existing image file by
reading back the data from the image file, calculating a hash value of that data, and
then comparing that calculated hash value with the value of the original acquisition
hash.
Note that, while the same Verify function can be used for standalone verification of
physical and logical images, the underlying mechanism is different. This is because
physical images contain whole disk acquisition hash values and logical images
contain file-based acquisition hash values. No difference will be noticed during the
verification job itself, but the source image type will make a difference in how the
results are reported. For a physical image verification job, the drive-level readback
hash values will be reported in the forensic log. For a logical image verification job, a
simple pass/fail indication will be reported in the forensic log. A pass indicates that
all the file-based verification hashes match the original acquisition file hashes. If any
individual file in a logical image file fails to verify, the entire verification job will
show as failed.
1. Follow the steps listed in “Connecting drives” on page 27 to connect the desired
destination drive.
Note: Verification jobs use only destination or accessory drives as the
source of the verification inputs.
2. Expand the Verify function tile on the home screen, and then tap the Start
button.
3. In the advanced settings screen, tap the Select a log file button to launch a
browse modal. Browse to the appropriate destination/accessory drive and
filesystem, locate the desired .td4_packed_log file, and select that file by
tapping it once. Then tap the Select button.
Note: When browsing for packed log files, only files with an extension
of .td4_packed_log will be shown in the browse window.
4. Review the selected filesystem and file path information, and, if accurate, tap the
Start button to begin the verification job. The Verify job status screen will
appear.
You may cancel an active Verify job by tapping Cancel in the bottom-right
corner of the job status screen. You may also Export the job log from this screen
(even for an in-progress job, if desired) by tapping the Export button in the
bottom-left corner and then selecting the desired destination or accessory drive/
filesystem.
Chapter 4 Using TD4
68
OpenText™ Tableau™ Forensic TD4 Duplicator
ISTD230100-UGD-EN-1