able to discern the state of encryption on the device. Care must be taken to
ensure that backup encryption is set to the desired state on Android devices
prior to beginning a mobile backup acquisition job on TX1.
Whether backup encryption was previously enabled on the mobile device or
enabled as part of the acquisition workflow, the password will need to be noted
as it will be required to access the backup file contents in the upstream forensic
investigation software tool. See “Mobile device media utilities” on page 154 for
more information on mobile device backup encryption for iOS and Android
devices.
Notes
• If there are source drives connected to TX1 in addition to mobile devices,
all of them will show in the sources list, but the non-mobile devices will
be grayed-out and not selectable for a mobile backup acquisition job.
• To help users identify which source devices have already been acquired,
a green checkmark is shown in the bottom right portion of the device tile
for any mobile device that has been used in a previous, successful mobile
backup acquisition job. For active jobs, a hollow checkmark will appear
which will turn solid green once the job has successfully completed.
• Within any screen displaying a list of devices, you can tap the Options
icon located on the right side of the device tile to see more details and
access any available media utilities.
Close the source selection modal by tapping the X in the upper right corner or by
tapping outside of the modal. If a different source is desired, simply go back into
the Select a mobile device screen by tapping on the 2 or Source heading from
the Mobile job setup stepper.
5. To change or add a destination drive/filesystem tap the 3 or Destination
heading. From the destination list modal, select one drive/filesystem from the
list.
Note: Unlike other types of TX1 jobs, only one destination drive/filesystem
can be selected for a mobile backup file acquisition job.
After selecting a filesystem, the default destination directory path is displayed.
To change the destination base directory, tap the orange Directory label to enter
a browse modal where you can select a different destination base directory,
create and select a new directory, or delete a directory. Tap one or more of the
four buttons (Date and Time, Model, Serial, or Case ID) under the directory
path to add variables as names for a destination sub-directory. Each variable can
only be selected once. Underscores are printed as separators between multiple
variable names.
To make a network share visible in the destination selection list of a mobile
backup acquisition job setup screen, first add and mount the share from the
Destinations drive list accessible on the Home screen. See “Duplication over a
network” on page 94 for more information on mounting iSCSI drives and CIFS/
SMB network shares.
Chapter 4 Using TX1
158
OpenText™ Tableau™ Forensic TX1 Imager
ISTX240300-UGD-EN-1
To Next Page
Loading...
