OpenText Tableau Forensic TX1 Imager
The Information Company 137
view these HTML logs in their styled format, please use the Logs menu item on the side
navigation bar.
4.8 Restoring
The Restore function allows for recreation of the original drive format from a previously
created TX1 image file. The uses for this feature are varied but include the ability to use a
restored drive as a system boot disk and to simply create an archival copy of the
evidence in its original format for future case reference.
The Restore function works with all physical duplication image file types (e01, ex01,
dd, dmg) It does not support restoration from a logical image file set (lx01).
Note that, at the beginning of a Restore job, TX1 prepares the destination drive by wiping
sectors 0, 1, and end-of-drive minus 1. This ensures there is no stale partition table data
on the drive which reduces the possibility of drive detection issues at the end of the job.
Note: Because partition table information is relative to the sector size of the source drive,
restoring to a destination drive with a different sector size is not allowed. TX1 will detect
this sector size mismatch issue and warn the user. This condition will need to be rectified
before the Restore job can be started.
To restore a drive from an image file:
1. Attach the desired source and destination media to TX1.
Note: The Restore function requires a Tableau packed log file as input, so ensure
that the desired packed log file is on a source drive (local or network) before starting
this operation.
2. From the Home screen, tap the Restore button.
Copyright © 2022 Open Text. All rights reserved. Trademarks owned by Open Text.
To Next Page
Loading...