Tableau TX1, User Manual

Page: 85 / 125

The Browse window for a given drive/share provides a brief description of the selected drive
(TX1 port name) in the header row. The second row of information includes drive utilization
information and a pulldown for selecting the desired filesystem. The third row provides
complete path information for the currently selected file/folder. Below the top three rows is
the main browse window, which shows the complete filesystem tree, including all folders/files
contained on the drive or share.
From the browser portion of the window, you can scroll up and down or tap individual folders
to drill down to the desired level to expose the names of individual files located on the drive.
Many users will find this utility helpful when attempting to triage a large evidence set and
determine the priority by which each drive should be imaged, or when checking the contents
of a destination drive to free up space by deleting unneeded directories and files.
Restore
The Restore function allows for recreation of the original drive format from a previously
created Tableau TX1 image file. The uses for this feature are varied, but include the ability to
use a restored drive as a system boot disk and to simply create an archival copy of the
evidence in its original format for future case reference.
To restore a drive from an image file:
1. Attach the desired source and destination media to the TX1.
Note: The restore function requires a Tableau packed log file as input, so ensure
that the desired packed log file is on a source drive (local or network) before starting
this operation.
2. From the Home screen, tap the Restore button.
3. Enter Job notes, select a Source drive, and then select a packed log file by browsing the
source and selecting the appropriate TX1 packed log file.
CHAPTER 4 Using the TX1 85