All the above output files are generated when a given destination is configured to be
the Lx01 + Metadata job type. No CSV metadata file is generated for the Lx01 job
type. No lx01 file set or .tx1_packed_log file is generated for the Metadata job type.
If all destinations are configured to be the Metadata job type, and no hashes are
configured, the file data for each file will not be read at all. This allows an
investigator to quickly create a record of all source file metadata.
4.5.3.3 Logical image verification
Verification of lx01 files differs from verification of physical imaging operations
because, in an lx01 file, there is no overall hash. Each file's data stored in the lx01 has
an associated hash that was calculated during the original acquisition. The logical
imaging verification function reads back the file data from the lx01 on the
destination, calculates a new hash value for each file, and compares that hash value
to the originally stored hash value. A failure of any one file to match the original
hash value will result in a verification/job failure.
4.5.3.4 Advanced logical imaging setup
The logical imaging setup of TX1 can be switched to Advanced Logical Imaging
mode. By enabling this setting in the Default settings screen, two additional search
setup options are activated. If Advanced Logical Imaging Setup is enabled but none
of its additional features are used, TX1 behaves the same as Basic mode except for
minor changes to log text.
Per search include/exclude switches
In Basic Logical Imaging Setup mode, all searches either include files or all searches
exclude files. With Advanced Logical Imaging Setup, this can optionally be
modified on a per search basis. This allows setup of complicated logical image jobs
that specify searches in precedence over other searches and over file/folder selection.
Note that this mode can be convoluted and confusing from a search logic
perspective, which is why the Basic search mode is used as the default.
Whether or not to include or exclude a given file/folder is determined by going
down the list of searches first. If a given search matches the file/folder, that file/
folder is included or excluded based upon the setting for that search. The earlier
search always takes precedence in this way.
If no search matches a file/folder, then whether that particular file/folder is included
or excluded is decided by the manual selection of files and folders.
• Define what to include ‒ all files and folders not matching Include searches and
not manually selected are not included.
• Define what to exclude ‒ all files and folders not matching Exclude searches and
not manually selected are included.
Note that new searches will use the top level include/exclude setting by default.
4.5. Logical imaging
ISTX240300-UGD-EN-1
User Guide
137
To Next Page
Loading...