The Custom Folder setting allows you to browse the source for a folder to match.
After selecting Custom Folder from the drop-down list, simply tap the Select Folder
button to launch a browse modal and select the desired folder.
Note: The full, absolute path name must be specified for Custom Folder
searches. The addition of the full absolute path is automatic when adding a
Custom Folder search during logical imaging job setup; however, when
adding a new search in the Default settings area (via the side navigation
menu), manual entry of the desired Custom Folder path is required. For
manual entry, you must use the forward slash (/) to specify the root directory
and spell out the complete path to the custom folder name (for example, /users/
suspectname/pics). Entering only a folder name without the absolute path
nomenclature will result in missed evidence. If you want to locate a folder
name without regard for the absolute path on the drive, use the Path Contains
search option and enter the desired folder name (for example, suspectname/
pics).
4.5.2.4 File size
The File Size search parameter restricts the search to apply to only files in a certain
range of sizes. The following file size search parameters are available:
• File Sizes >=
• File Sizes <=
• File Sizes in Range
File Sizes >= lets you specify a file size in bytes, KB, MB, or GB and match only files
greater than or equal to the specified size.
File Sizes <= lets you specify a file size in bytes, KB, MB, or GB and match only files
less than or equal to the specified size.
File Sizes in Range lets you specify two file sizes, and match only files with size in
between the two specified sizes.
4.5.2.5 File date
The File Date search parameter restricts the search to apply to only files in
timestamp ranges, as follows:
• File Dates >=
• File Dates <=
• File Dates in Range
File Dates >= lets you specify a date and only match files with one or more
timestamps on or after the given date.
File Dates <= lets you specify a date and will only match files with one or more
timestamps on or before the given date.
Chapter 4 Using TX1
134
OpenText™ Tableau™ Forensic TX1 Imager
ISTX240300-UGD-EN-1
To Next Page
Loading...
