Tableau TX1, User Manual

Page: 58 / 125

Used in conjunction with physical disk imaging, logical imaging enables rapid acquisition of
source file data, providing TX1 users the ability to balance thoroughness with acquisition time
and effort for the demands of a given case.
The logical imaging function can be configured to create logical evidence files (Lx01 format)
and/or metadata lists (comma separated value (CSV) format). The industry standard Lx01
logical evidence file format can be used with a variety of post-acquisition forensic analysis
software tools, such as industry-leading EnCase. The CSV metadata files can be configured to
contain the metadata from only the files that were acquired in the Lx01 file or from all the
source files. Acquiring all source file/folder metadata provides a trail of what data was and was
not acquired during the operation. This allows an investigator to quickly analyze a summary of
the filesystem involved in the job.
Due to the wide range of variables in a logical image job, such as file data compressibility and
acquisition dataset size, it is not possible to determine with certainty if the data from a source
filesystem will fit on a destination filesystem. As a result, the TX1 only warns the user that a
destination may be too small when the used space of the source filesystem is larger than the
available space on the destination, but the job can still be started. In a worst-case scenario
(compression disabled and no source file down-selection), it is possible for the destination
filesystem to become full, thus causing the job to fail.
Note: Use caution when attempting to logically image from a source filesystem to a
smaller destination filesystem.
Performing a Logical Image Acquisition
To perform a logical image:
1. Follow the steps listed in Connecting Drives on page 30 to connect the source drive and
all relevant destination drives.
2. From the Home screen, tap the Logical icon. The Logical Image job setup screen displays.
58 Tableau TX1 User Guide Version 2.0