OpenText Tableau Forensic TX1 Imager
The Information Company 151
nuanced Core Storage configurations exist that would prevent unequivocal FileVault 2
detection. In those cases, TX1 will revert to a warning message that indicates Core
Storage has been detected and that FileVault 2 is possible.
4.9.2 RAID detection
In addition to encryption detection, TX1 will automatically detect drives that were
originally part of certain types of RAID systems. RAID detection is based on the existence
of known signatures in specific locations on these drives. Due to the nature of the RAID
specifications over time and industry adoption nuances (including many proprietary
systems that do not follow all the specifications, and mixes of hardware and software-
based RAID systems), it is not possible to comprehensively identify all RAID system
drives. Sometimes only the primary drive in a RAID set is detectable or has detailed
metadata describing the RAID setup. However, some RAID system drives can be reliably
detected, and knowing about them can be of forensic value.
TX1 will detect drives from the following RAID system types:
• Intel RST (BIOS)
• SNIA DDF
• Linux MD
• Adaptec HostRAID ASR
Copyright © 2022 Open Text. All rights reserved. Trademarks owned by Open Text.
To Next Page
Loading...