OPENTEXT Tableau Forensic TX1 - Restoring

Image type .apng, .bmp, .gif, .ico, .cur, .jpg, .jpeg, .jfif, .pjpeg, .pjp, .png, .s
vg, .webp
TX1 packed log type “tx1_packed_log”
While it is possible to view the text version of a TX1 forensic log file via the Browse
feature, for security reasons, the HTML log files will appear as raw HTML text. In
order to view these HTML logs in their styled format, please use the Logs menu item
on the side navigation bar.
4.8 Restoring
The Restore function allows for recreation of the original drive format from a
previously created TX1 image file. The uses for this feature are varied but include
the ability to use a restored drive as a system boot disk and to simply create an
archival copy of the evidence in its original format for future case reference.
The Restore function works with all physical duplication image file types (e01,
ex01, dd, dmg) It does not support restoration from a logical image file set (lx01).
Note that, at the beginning of a Restore job, TX1 prepares the destination drive by
wiping sectors 0, 1, and end-of-drive minus 1. This ensures there is no stale partition
table data on the drive which reduces the possibility of drive detection issues at the
end of the job.
Note: Because partition table information is relative to the sector size of the
source drive, restoring to a destination drive with a different sector size is not
allowed. TX1 will detect this sector size mismatch issue and warn the user.
This condition will need to be rectified before the Restore job can be started.
To restore a drive from an image file:
1. Attach the desired source and destination media to TX1.
Note: The Restore function requires a Tableau packed log file as input, so
ensure that the desired packed log file is on a source drive (local or
network) before starting this operation.
2. From the Home screen, tap the Restore button.
3. Enter Job notes, select a Source drive, and then select a Packed log file by
browsing the source and selecting the appropriate TX1 packed log file.
Chapter 4 Using TX1
148
OpenText™ Tableau™ Forensic TX1 Imager
ISTX240300-UGD-EN-1