The logical imaging function can be configured to create logical evidence files (lx01
format) and/or metadata lists (comma separated value csv format). The industry
standard lx01 logical evidence file format can be used with a variety of post-
acquisition forensic analysis software tools, such as industry leading EnCase. The
CSV metadata files can be configured to contain the metadata from only the files that
were acquired in the lx01 file or from all the source files. Acquiring all source file/
folder metadata provides a trail of what data was and was not acquired during the
operation. This allows an investigator to quickly analyze a summary of the
filesystem involved in the job.
Due to the wide range of variables in a logical image job, such as file data
compressibility and acquisition dataset size, it is not possible to determine with
certainty if the data from a source filesystem will fit on a destination filesystem. As a
result, TX1 only warns the user that a destination may be too small when the used
space of the source filesystem is larger than the available space on the destination,
but the job can still be started. In a worst-case scenario (compression disabled and no
source file down-selection), it is possible for the destination filesystem to become
full, thus causing the job to fail.
Note: Use caution when attempting to logically image from a source filesystem
to a smaller destination filesystem.
4.5.1 Performing a logical image acquisition
To perform a logical image acquisition:
1. Follow the steps listed in “Connecting drives” on page 70 to connect the source
drive and all relevant destination drives.
2. From the Home screen, tap the Logical icon. The Logical Image job setup screen
will be displayed, as shown below.
Chapter 4 Using TX1
118
OpenText™ Tableau™ Forensic TX1 Imager
ISTX240300-UGD-EN-1
To Next Page
Loading...
