Caution
Docking station type devices that have Opal drives in them must support
ATA command pass-through for TX1 to properly detect the presence of
Opal encryption and allow it to be unlocked. Docking stations that do not
support ATA command pass-through may present locked Opal media as
all zeros with no indication of Opal encryption being present in the TX1
user interface. Use caution when acquiring any docking station-based
media. If you suspect a drive in a docking station is Opal-encrypted, but is
not being presented that way in the TX1 user interface, removing the drive
from the enclosure and connecting it directly to TX1 may yield the desired
outcome.
4.10.1.2 Apple Core Storage and FileVault 2
TX1 can detect Apple Core Storage partitions and the presence of FileVault 2
encryption. FileVault 2 encryption will be indicated in both the user interface and
the forensic log. The screenshots below show how FileVault 2 encryption will be
indicated in the TX1 user interface.
Note: There are many possible ways to configure Apple Core Storage volumes
with FileVault 2 encryption. TX1 has been designed to catch them all, but it is
possible that nuanced Core Storage configurations exist that would prevent
unequivocal FileVault 2 detection. In those cases, TX1 will revert to a warning
message that indicates Core Storage has been detected and that FileVault 2 is
possible.
4.10. Viewing sources and destinations
ISTX240300-UGD-EN-1
User Guide
177
To Next Page
Loading...
