OPENTEXT Tableau TX1 - Using automated acquisition

To Next Page

To Previous Page

74 The Information Company

duplication job setup. The default setting is Date and Time. See “Performing a

duplication” on page 66 for more details.

[filename] is the base image filename and is defined in “Imaging” on page 65 during

duplication job setup.

[filename] .001 (or .E01 or .Ex01) is the first segment or portion of the data copied

from the source drive. All other segments have standard segment names (for

example, [filename].002, [filename].003, and so on).

TX1 generates a .LOG file for each image job. It also creates a .tx1_packed_log file,

which can be used to do a standalone verification of the original image or to Restore an

image file to the original drive format.

4.3.4 Using automated acquisition

TX1 can be set up to run in Automated Acquisition mode, which will start a duplication job

(clone or physical image) when any source drive is detected by the system. Custom job

parameters can be set to the user’s liking when enabling this mode, and those settings

will be used for all subsequent jobs within that automated run. This is a convenient way to

quickly start jobs when you have many evidence drives to acquire as quickly as possible.

This mode can also be used in a kiosk environment, where TX1 is always on waiting for a

drive to be plugged in to start a duplication job. When used in conjunction with the ability

to store forensic image files on a network-based iSCSI drive or CIFS share, this is a

convenient way to quickly acquire as much evidence as possible with little user training,

and make that evidence available to everyone in your network environment.

The steps below are focused on Automated Acquisition mode setup. Please refer to the

more general Performing a duplication job setup workflow steps in the previous section

for basic duplication job setup information.

Note: Automated acquisition is available for duplication (clone or image) jobs only.

Logical imaging jobs typically involve custom analysis, triage, and targeted file set

acquisitions, which are not aligned well with the goals of automated acquisition.