Tableau TX1, Руководство пользователя

Страница: 68 / 125

File Sizes <= lets you specify a file size in bytes, KB, MB, or GB and match only files less than or
equal to the specified size.
File Sizes in Range lets you specify two file sizes, and match only files with size in between the
two specified sizes.
File Date
The File Date search parameter restricts the search to apply to only files in timestamp ranges,
as follows:
l
File Dates >=
l
File Dates <=
l
File Dates in Range
File Dates >= lets you specify a date and only match files with one or more timestamps on or
after the given date.
File Dates <= lets you specify a date and will only match files with one or more timestamps on
or before the given date.
File Dates in Range lets you specify two dates and will only match files with one or more
timestamps on or between the two given dates.
Dates are entered by typing them into the text boxes in YYY-MM-DD format. Dates will match
the rule if any of the TX1 supported timestamps for that filesystem match the File Date setting.
Note: Some filesystem types, particularly FAT32, do not support time zone
independent timestamps. There is no way to determine the time zone used for
FAT32 time stamps created by Windows. The TX1 treats these timestamps as if
created with a UTC+0000 timestamp.
7. To select the destination drive(s) tap the 4 or Destination(s) heading. All available des-
tination drives will be shown in a modal window, with a tile shown below each drive to
show its recognized filesystem(s). Tap the desired destination filesystem(s) (up to four)
and the selected filesystem tile will show in green, with a checkbox added to its parent
drive tile. Selecting a filesystem will also open a drawer under the filesystem tile, which
shows the options for logical imaging destinations, as follows:
o
Job type – This allows selection of the desired output files types. The main logical
evidence file format for TX1 is Lx01, which will contain all the data and metadata for
every acquired file and folder. Additionally, the TX1 offers the ability to generate a
68 Tableau TX1 User Guide Version 2.0