OPENTEXT Tableau Forensic TX1 - Files Created During Android Device Backup Acquisition

reading back the files from the destination (to pack them into the Lx01 segment
files), all will show as “OK”. If there was an issue while reading the files back,
the job will fail and the offending file will show an “Error” status in the CSV file.
• Matched Rules – For mobile backup acquisition jobs, this will always indicate
“Y” for yes. This field is more pertinent to logical imaging jobs, which use it to
indicate if a given file was part of a targeted/filtered collection.
[image name].log.html/txt - TX1 generates two forensic log file formats for each
job (mobile backup acquisition included) - one in html format and one in text format.
These logs are accessible through the Logs list in the side navigation menu. They can
also be exported to a destination drive/filesystem (local or network based) for
further analysis and/or case documentation purposes.
[image_name].Lx01, [image_name].Lx02, ... are the forensic evidence files for the
operation. They contain all the data and metadata for each acquired mobile backup
file and folder.
4.9.5.2 Files created during Android device backup acquisition
The output files generated by TX1 during backup acquisition of an Android based
mobile device depend on the File output setting. The two options are Native and
Lx01.
Native Android backup acquisition job output files
Currently, the files created by an Android mobile device during a Native file type
backup are written to the destination drive according to the following convention:
[image base directory]/
[directory name]/
[image name]/
[image name].ab
[image name].csv
[image name].log.html
[image name].log.txt
[image base directory]
is defined in Setting Defaults or when selecting a
destination drive. The default is /tx1_images/.
[directory name] is the image sub-directory name auto-generated for each
acquisition and is defined in Setting Defaults or when selecting a destination drive
during mobile backup acquisition job setup. The default setting is Date and Time.
[image name] is the base folder used by TX1 to store the Android backup file ([image
name].ab).
[image name].csv is the TX1 generated mobile backup acquisition job metadata file.
It contains the following information for each file acquired during the backup job:
• Path – The overall path name of the folder/file as written to the destination drive/
filesystem.
• Type – Identification of the path type (Directory or File)
4.9. Mobile backup acquisition
ISTX240300-UGD-EN-1
User Guide
165