Tableau TX1, User Manual

Page: 57 / 125

To cancel the hash operation, close the Job Status screen by tapping the X in the upper right
hand corner and then tap the Cancel button from the Active Jobs section at the top of the
Jobs summary screen.
When the hash operation is finished, the results display on the screen. To access the forensic
log of the hash job, simply tap the View Log button in the header of the completed Job Status
screen. You can also view the log information by selecting
Logs from the Side Navigation menu.
Logical Imaging
The TX1 provides a powerful logical imaging function that allows for file-based evidence
acquisition from locally attached and network-based source filesystems. This tool saves
valuable time by focusing on specific files of interest rather than acquiring the entire physical
drive. TX1 logical imaging understands the structure of the recognized filesystem and acquires
the desired source file data and/or metadata.
Logical imaging operations on the TX1 can be targeted, limiting which files are acquired to only
a subset of the source filesystem. The TX1 allows both direct selection of contents to acquire,
as well as rule-based searches to target specific files based on file type or other criteria. This
allows for a more targeted and faster acquisition of only the files that are of forensic interest.
CHAPTER 4 Using the TX1 57