OPENTEXT Tableau TX1 - Logical imaging

To Next Page

To Previous Page

OpenText Tableau Forensic TX1 Imager

The Information Company 105

4. To cancel the hash operation, close the Job Status screen by tapping the X in the

upper right corner, and then tap the Cancel button from the Active Jobs area at the

top of the Jobs summary screen.

When the has

h operation is finished, the results display on the screen. To access the

forensic log of the hash job, simply tap the View Log button in the header of the

completed Job Status screen. You can also view the log information by selecting Logs

from the side navigation menu.

4.5 Logical imaging

TX1 provides a powerful logical imaging function that allows for file-based evidence

acquisition from locally attached and network-based source filesystems. This tool saves

valuable time by focusing on specific files of interest rather than acquiring the entire

physical drive. TX1 logical imaging understands the structure of the recognized

filesystem and acquires the desired source file data and/or metadata.

Logical imaging operations on TX1 can be targeted, limiting which files are acquired to

only a subset of the source filesystem. TX1 allows both direct selection of contents to

acquire, as well as rule-based searches to target specific files based on file type or other

criteria. This allows for a more targeted and faster acquisition of only the files that are of

forensic interest. Used in conjunction with physical disk imaging, logical imaging enables