4.5.5 Folders
During logical imaging, TX1 can use the following predefined paths associated with
User and Operating System folders.
Folder Type Folder Name
User Folders /Users/, /Documents And Settings/, /WinNT/Profiles/, /var/
users/, /users/, /u01/, /user/, /home/, /root/, /export/home/
Operating System
Folders
/Windows/, /WinNT/, /System/, /Program Files/, /Program
Files (x86)/, /ProgramData/, /Applications/, /bin/, /dev/, /
etc/, /sbin/, /usr/, /boot/, /lib/, /proc/, /sys/, /unix/
4.5.6 Source file metadata
Logical imaging with TX1 includes source file metadata in the csv output file.
Column Content
Path Contains the full, filesystem-relative path for this entry.
Example: /users/charles/pictures.
Type Either contains “Directory,” “Symlink,” or “File,” depending
on what kind of entry this row represents.
Filesize The file size, in bytes, of the entry. This field is empty for
directories.
Creation Date The IS0 8601 UTC date/time string for the creation date of
this entry. This field is empty if the creation date is
unavailable.
Accessed Date The IS0 8601 UTC date/time string for the accessed date of
this entry. This field is empty if the accessed date is
unavailable.
Modified Date The IS0 8601 UTC date/time string for the modified date of
this entry. This field is empty if the modified date is
unavailable.
Written Date The IS0 8601 UTC date/time string for the written date of this
entry. This field is empty if the written date is unavailable.
MD5 Hash The MD5 Hash of the entry. This field is empty for
directories. It is also empty if no MD5 hash was calculated,
no MD5 hash was configured, or the entry did not match the
rules for acquisition.
SHA1 Hash The SHA1 Hash of the entry. This field is empty for
directories. It is also empty if no SHA1 hash was calculated,
no SHA1 hash was configured, or the entry did not match the
rules for acquisition.
Chapter 4 Using TX1
140
OpenText™ Tableau™ Forensic TX1 Imager
ISTX240300-UGD-EN-1
To Next Page
Loading...
