Tableau TX1, User Manual

Page: 71 / 125

Select the desired hash type for the logical image job - MD5 and/or SHA-1. Note that hash
values for source files will be calculated based on the chosen hash settings, even if no Lx01
outputs are requested. In that case, the file data is still read to allow for hash calculation, and
the file-based hash values are stored in the metadata output file.
Enable or disable read-back verification. Read-back verification is not possible if no Lx01
outputs have been configured or if no hashes have been selected.
Set the desired source read error handling mechanism for the job – Continue on error or Stop
on error. Note that read error handling in logical image jobs is distinct from that of physical
image jobs in that retries are not allowed. This is because file read errors will typically not
succeed after an initial failed read. Therefore, for logical image jobs, the only error handling
setting decision to make is whether to continue with the job (skipping the unreadable file(s)) or
to stop the job as soon as the first file read error is encountered.
Note: When a read of a given source file fails and the “Continue on error” setting is
active, the unreadable file will not be acquired. In that case, the metadata output file
will show an error condition in the entry for the unreadable file, and the Lx01 will
indicate the error condition, which enables forensic analysis tools such as EnCase to
indicate an error for the affected file(s).
The default output image name is shown and can be changed by tapping the field and typing
in the desired name.
The default image file segment size is shown and can be changed by tapping the desired size.
Note that this setting is unavailable if no Lx01 output has been requested.
Compression can be enabled/disabled. Note that this setting is unavailable if no Lx01 output
has been requested.
If a metadata list was chosen as part of the destination settings, the following options for what
to include in that metadata list will be shown at the bottom of the Settings section: Matching
files or All files. If Matching files is selected, only the metadata for files that were acquired
during the job will be included, whereas All files will obviously include a metadata entry for
each file on the source, regardless of whether it was acquired or not. The latter setting may be
useful in cases where time or other constraints only allowed partial source file gathering.
9. Once you are satisfied with all the logical image job settings, tap the Start Logical Image
button.
CHAPTER 4 Using the TX1 71