Tableau TX1, User Manual

Page: 66 / 125

l
Each of the search parameter fields makes use of drop-down selection boxes to help
guide the setup of each parameter.
The following sections cover each of the search parameter fields.
File Type
The File type search parameter restricts the search to apply only to files that match a list of file
extensions. Each search can have any number of file type constraints. When multiple file type
constraints are included in a given search, a match of any one of them will include/exclude a
given file.
The following file type search parameters are available:
l
Archives
l
Databases
l
Documents
l
Emails
l
Multimedia
l
Pictures
l
Custom
Each type other than “Custom” has a predefined list of extensions known to be associated
with that type of file. The lists can be seen by tapping the blue help button (circle with question
mark) to the right of the file type parameter field. All extensions associated with each file type
are found in File Extensions on page 75.
Using the Custom field allows for manual entry of any extension values to match against. The
entry of custom extension values is done outside of the pull-down selection box.
The forensic log associated with the logical image job contains exactly what extensions were
used for each search, along with which selections were used to create that list.
Note: Searching by file type does not use file signature analysis to determine what
type a file is. Only the file name extension is used to determine a match. If file
signature analysis is required for a given job, a physical image should be made
(possibly in addition to a logical image) to ensure all source data is available for use
with external forensic data analysis tools.
66 Tableau TX1 User Guide Version 2.0