OPENTEXT Tableau TX1 - Performing a logical image acquisition

To Next Page

To Previous Page

106 The Information Company

rapid acquisition of source file data, providing TX1 users the ability to balance

thoroughness with acquisition time and effort for the demands of a given case.

The logical imaging function can be configured to create logical evidence files (lx01

format) and/or metadata lists (comma separated value csv format). The industry standard

lx01 logical evidence file format can be used with a variety of post-acquisition forensic

analysis software tools, such as industry leading EnCase. The CSV metadata files can be

configured to contain the metadata from only the files that were acquired in the lx01 file or

from all the source files. Acquiring all source file/folder metadata provides a trail of what

data was and was not acquired during the operation. This allows an investigator to

quickly analyze a summary of the filesystem involved in the job.

Due to the wide range of variables in a logical image job, such as file data compressibility

and acquisition dataset size, it is not possible to determine with certainty if the data from

a source filesystem will fit on a destination filesystem. As a result, TX1 only warns the

user that a destination may be too small when the used space of the source filesystem is

larger than the available space on the destination, but the job can still be started. In a

worst-case scenario (compression disabled and no source file down-selection), it is

possible for the destination filesystem to become full, thus causing the job to fail.

Note: Use caution when attempting to logically image from a source filesystem to a

smaller destination filesystem.

4.5.1 Performing a logical image acquisition

To perform a logical image acquisition:

1. Follow the steps listed in “Connecting drives” on page 61 to connect the source drive

and all relevant destination drives.