Tableau TX1, User Manual

Page: 74 / 125

Files Created During Logical Imaging
When performing a logical image on the TX1, multiple different files may be output to each
destination depending on the job configuration, as follows:
l
{image_name}.log
contains the forensic log of the logical imaging operation.
l
{image_name}.Lx01
,
{image_name}.Lx02
, … are the forensic evidence files for the
operation. They contain all the data and metadata for each file and folder acquired.
l
{image_name}.csv
is a comma separated value store of all the metadata for every file
and folder acquired. Optionally, this file also contains all the metadata for files and folders
that were not acquired. This type of file can easily be imported into many common data
processing applications such as Microsoft Excel. CSV file data contents and format inform-
ation can be found at Source File Metadata on page 79.
l
{image_name}.tx1_packed_log
contains a TX1 readable copy of the forensic log that
can be used for later standalone verification of the Lx01 file set.
All the above output files are generated when a given destination is configured to be the Lx01 +
Metadata job type. No metadata (.csv) file is generated for the Lx01 job type. No
.Lx01
file set
or
.tx1_packed_log
file is generated for the Metadata job type.
If all destinations are configured to be the Metadata job type, and no hashes are configured,
the file data for each file will not be read at all. This allows an investigator to quickly create a
record of all source file metadata.
Logical Image Verification
Verification of Lx01 files differs from verification of physical imaging operations because, in an
Lx01 file, there is no overall hash. Each file’s data stored in the Lx01 has an associated hash that
was calculated during the original acquisition. The logical imaging verification function reads
back the file data from the Lx01 on the destination, calculates a new hash value for each file,
and compares that hash value to the original stored hash value. A failure of any one file to
match the original hash value will result in a verification/job failure.
Advanced Logical Imaging Setup
The logical imaging setup of the TX1 can be switched to Advanced Logical Imaging Setup mode.
By enabling this setting in the default settings screen, two additional search setup options are
activated. If Advanced Logical Imaging Setup is enabled but none of its additional features are
used, the TX1 behaves the same as Basic mode except for minor changes to log text.
74 Tableau TX1 User Guide Version 2.0