Tableau TX1, User Manual

Page: 80 / 125

Column Content
Written Date
The IS0 8601 UTC date/time string for the written date of
this entry. This field is empty if the written date is
unavailable.
MD5 Hash
The MD5 Hash of the entry. This field is empty for
directories. It is also empty if no MD5 hash was
calculated, no MD5 hash was configured, or the entry
did not match the rules for acquisition.
SHA1 Hash
The SHA1 Hash of the entry. This field is empty for
directories. It is also empty if no SHA1 hash was
calculated, no SHA1 hash was configured, or the entry
did not match the rules for acquisition.
File Status
OK
if there were no problems reading file
data/metadata.
ERRORS
if there were errors reading file
data and/or metadata. This field is empty for
directories.
Matched Rules
“Y” if the file matched the acquisition’s rules for
inclusion.
Verifying
The standalone Verify function verifies the integrity of an existing image file by reading back
the data from the image file, calculating a hash value of that data, and then comparing that
calculated hash value with the value of the original acquisition hash.
Note that, while the same Verify function can be used for standalone verification of physical
and logical images, the underlying mechanism is different. This is because physical images
contain whole disk acquisition hash values and logical images contain file-based acquisition
hash values. No difference will be noticed during the verification job itself, but the source
image type will make a difference in how the results are reported. For a physical image
verification job, the drive level readback hash values will be reported in the forensic log. For a
logical image verification job, a simple pass/fail indication will be reported in the forensic log,
which indicates that all the file-based acquisition hashes matched the readback hash values. If
any individual file in a logical image file failed to verify, the entire verification job would show as
failed.
80 Tableau TX1 User Guide Version 2.0