destination filesystem(s) (up to four) and the selected filesystem tile will show in
green, with a checkbox added to its parent drive tile. Selecting a filesystem will
also open a drawer under the filesystem tile, which shows the options for logical
imaging destinations, as follows:
• Job type: This allows selection of the desired output files types. The main
logical evidence file format for TX1 is lx01, which will contain all the data
and metadata for every acquired file and folder. Additionally, TX1 offers the
ability to generate a Metadata file in the common CSV (comma separated
values) format, which contains all the available metadata for every acquired
file and folder. Optionally, the metadata output file can be configured to
contain all the metadata for all the files/folders on the source drive (whether
the actual files/folders were acquired or not). That setting is made in the
Settings area of the logical image job setup screen. The Job type setting
options for the selected filesystem are: Lx01, Lx01 + Metadata, and Metadata.
See “Source file metadata” on page 140 below for more information
regarding captured metadata.
• Directory: This identifies in which directory the logical image job output files
will be stored. The default directory will initially be shown, which can be
changed by tapping on the orange Directory label to enter a Browse modal
where you can select a different destination base directory, create and select a
new directory, or delete a directory. Tap one or more of the four buttons
(Date and Time, Model, Serial, or Case ID) under the directory path to add
variables as names for a destination sub-directory. Each variable can only be
selected once. Underscores are printed as separators between multiple
variable names.
4.5. Logical imaging
ISTX240300-UGD-EN-1
User Guide
125
To Next Page
Loading...
