[filename] is the base image filename and is defined in “Imaging” on page 77
during duplication job setup.
[filename] .001 (or .E01 or .Ex01) is the first segment or portion of the data copied
from the source drive. All other segments have standard segment names (for
example, [filename].002, [filename].003, and so on).
TX1 generates a .LOG file for each image job. It also creates a .tx1_packed_log file,
which can be used to do a standalone verification of the original image or to Restore
an image file to the original drive format.
4.3.4 Using automated acquisition
TX1 can be set up to run in Automated Acquisition mode, which will start a
duplication job (physical image type) when any source drive is detected by the
system. Custom job parameters can be set to the user's liking when enabling this
mode, and those settings will be used for all subsequent jobs within that automated
run. This is a convenient way to quickly start jobs when you have many evidence
drives to acquire as quickly as possible. This mode can also be used in a kiosk
environment, where TX1 is always on waiting for a drive to be plugged in to start a
duplication job. When used in conjunction with the ability to store forensic image
files on a network-based iSCSI drive or CIFS share, this is a convenient way to
quickly acquire as much evidence as possible with little user training, and make that
evidence available to everyone in your network environment.
The steps below are focused on Automated Acquisition mode setup. Please refer to
the more general “Performing a duplication” on page 77 job setup workflow steps in
the previous section for basic duplication job setup information.
Note: Automated acquisition is available for duplication (physical image type)
jobs only. Logical imaging jobs typically involve custom analysis, triage, and
targeted file set acquisitions, which are not aligned well with the goals of
automated acquisition. Automated acquisition jobs do not support clone type
duplication jobs because subsequent automated clone jobs would overwrite the
destination, effectively deleting the previous automated clone acquisition.
To set up Automated Acquisition mode:
1. From the Home screen, tap the Duplicate icon. The Duplicate job setup screen is
displayed.
Chapter 4 Using TX1
86
OpenText™ Tableau™ Forensic TX1 Imager
ISTX240300-UGD-EN-1
To Next Page
Loading...
