Invert switches for individual search parameters
In Advanced Logical Imaging Setup mode, each search parameter has an invert
toggle. This lets the parameter match the opposite set of files from what it normally
matches for that parameter.
For example, if you create a search that matches Archives and File Sizes in Range 1
MB to 100 MB, two switches will appear next to those two settings. If you enable the
invert switch next to Archives, the rule now matches any file that is not an Archive.
If you enable the switch next to the File Sizes range, the rule will now match any file
outside the range 1 MB to 100 MB. You can switch one or both conditions to match
the kind of files you are searching for.
In general, Basic search mode is recommended unless there is a compelling reason
to switch to Advanced Logical Imaging Setup mode to target specific source
evidence.
4.5.4 File extensions
During logical imaging, TX1 can search for file types with any of the following
extensions.
File Type File Extension
Archives 7z, 7zip zom, apk, xxe, uug, mim, tz, arj, zsm, zze, boo, bkp,
bak, sav, bac, ful, bag, zso, bplist, bhx, mhk, bz, bz2, ckit, boz,
ish, rar, r01, jar, cru, cif, gnu, gz, tgz, gzip, ha, hap, lzs, lha,
arc, lzh, pak, hqx, image, sparseimage, marc, cab, b64, gho,
rpm, rzip, rz, sea, sdn, stf, squashfs, sqz, sit, sitx, td0, ufa, bar,
cpio, taz, z, tar, tgz, uu, uue, xcr, yz, yc, zdg, zip, zoo
Databases asl, cdb, ntx, csv, dbf, idx, ind, dbk, bch, db2, db3, ndx, cvt,
crp, mdx, $db, db$, fp, pjx, mda, mdt, mdn, mdb, mde, ldb,
mar, mdw, mny, wdb, mlb, odb, sqlite, sdb, db, sqlite3, sqlite,
kexi, shm, db-wal, sqlite-wal, cix, dba
Chapter 4 Using TX1
138
OpenText™ Tableau™ Forensic TX1 Imager
ISTX240300-UGD-EN-1
To Next Page
Loading...
