Tableau TX1, User Manual

Page: 75 / 125

Per Search Include/Exclude switches
In Basic Logical Imaging Setup mode, all searches either include files or all searches exclude
files. With Advanced Logical Imaging setup, this can optionally be modified on a per search
basis. This allows setup of complicated logical image jobs that specify searches in precedence
over other searches and over file/folder selection. Note that this mode can be convoluted and
confusing from a search logic perspective, which is why the basic search mode is used as the
default.
Whether or not to include or exclude a given file/folder is determined by going down the list of
searches first. If a given search matches the file/folder, that file/folder is included or excluded
based upon the setting for that search. The earlier search always takes precedence in this way.
If no search matches a file/folder, then whether that particular file/folder is included or
excluded is decided by the manual selection of files and folders.
l
Define what to include – all files and folders not matching Include searches and not manu-
ally selected are not included.
l
Define what to exclude – all files and folders not matching Exclude searches and not manu-
ally selected are included.
Note that new searches will use the top level include/exclude setting by default.
Invert switches for individual search parameters
In Advanced Logical Imaging Setup mode, each search parameter has an invert toggle. This lets
the parameter match the opposite set of files from what it normally matches for that
parameter.
For example, if you create a search that matches Archives and File Sizes in Range 1 MB to 100
MB, two switches will appear next to those two settings. If you enable the invert switch next to
Archives, the rule now matches any file that is not an Archive. If you enable the switch next to
the file size range, the rule will now match any file outside the range 1MB to 100MB. You can
switch one or both conditions to match the kind of files you are searching for.
In general, Basic search mode is recommended unless there is a compelling reason to switch to
Advanced Logical Imaging Setup mode to target specific source evidence.
File Extensions
During logical imaging, Tableau TX1 can search for file types with any of the following
extensions.
CHAPTER 4 Using the TX1 75