OPENTEXT Tableau TX1 - Cloning; Imaging

To Next Page

To Previous Page

OpenText Tableau Forensic TX1 Imager

The Information Company 65

4.3.1 Cloning

A clone, also known as a disk-to-disk duplication, makes an exact copy of the source

drive to the destination drive(s).

If a destination drive is not blank, TX1 displays a yellow warning to indicate that a clone

will overwrite the contents of the destination drive. This reduces the risk of overwriting

valuable data.

There is no need to format the destination media, as the clone will apply the file system of

the source media (if one exists) to the destination media automatically. It is, however, a

best practice to wipe destination media before duplicating to it as this can help to identify

potentially defective media and bad sectors, and it can reduce the risk of cross-

contaminating a duplication with stale data.

Note that, at the beginning of a clone job, TX1 prepares the destination drive by wiping

sectors 0, 1, and end-of-drive minus 1. This ensures there is no stale partition table data

on the drive, which reduces the possibility of drive detection issues at the end of the job.

Note: Because partition table information is relative to the sector size of the source drive,

cloning to a destination drive with a different sector size is not allowed. TX1 will detect

this sector size mismatch issue and warn the user. This condition will need to be rectified

before the clone job can be started.

4.3.2 Imaging

An image, also known as disk-to-file duplication, copies the source drive to a series of

files (sometimes called segments or chunks) on the destination drive. TX1 supports

EnCase file formats ex01 and e01 and raw file formats dd and dmg. Compression is

supported, and enabled by default, with ex01 and e01 file formats. File sizes from 2 GB

per segment to Unlimited are supported. Smaller segments create more directory entries

and Unlimited creates one large file segment.

Note: Not all image file size options are available in all situations. Due to filesystem

addressing limitations, FAT32 formatted destinations have a maximum file size of 2 GB.

When imaging, the destination media must first be formatted with a recognized

filesystem. Format destination drives by selecting the Format media utility in the drive

details screen. The drive details screen can be accessed through the Destinations

button on the Home screen or through the Select Destinations screen during setup of a

duplication job.

If the destination drive is smaller than the source, a dd or dmg image will not fit on the

destination drive. However, if using ex01 or e01, the source drive may fit on a smaller

drive because these formats can compress the data before writing to the destination

drive. There is no guarantee that the data will be compressed enough to fit on a smaller

destination drive, especially if in cases where the data is mostly incompressible such as

encrypted data.