OpenText Tableau TD2u Forensic Duplicator
The Information Company
31
Historically, disks have been formatted with the first partition located at sector
63. However, if a host computer aligns partitions and clusters of 512-byte sectors on
boundaries that are not a multiple of 8, then the frequency with which the drive must
resort to read-modify-write cycles can severely degrade performance.
The TD2u recognizes AF disks. In order to maximize performance, it formats them
accordingly with partitions and clusters positioned at sector locations that are a multiple
of 8.
F
ORMAT
D
ESTINATION
(M
ENU
5.1.1)
The
Format Destination
option allows you to format destination disks with the ExFAT file
system used by the TD2u. The TD2u performs what is generally referred to as a Quick
Format, during which it writes the necessary Master Boot Record, Partition Boot Record,
and data structures to the destination disk. The TD2u does not do a full surface scan of
the destination disk. If you want to verify the integrity of the destination disk you should
format it using the disk utilities of a traditional computer and operating system.
You do not need to preformat destination drives when using the disk-to-file duplication
mode of the TD2u. If a destination disk is unformatted and not blank, the TD2u prompts
you to format the disk before it begins the duplication. If a destination disk is unformatted
and appears to be blank, the TD2u automatically formats it.
The TD2u only formats disks using ExFAT; however, disks that have been preformatted
with FAT32 can be used on the system.
F
ORMAT
USB
A
CCESSORY
(M
ENU
5.1.2)
The
Format USB Accessory
option allows you to quickly format a USB disk connected
to the rear accessory port. It works the same as formatting a destination, except it
operates on the accessory port rather than any destination disks.
4.8.2 Hash (Menu 5.2)
There are times when a forensic practitioner would like to calculate the hash values, or
fingerprints, for a source disk without making a copy of the disk. With the
Hash Utilities
menu, you can generate MD5, SHA-1, SHA-256 hash values for the hard disk attached to
the source side of the TD2u.
You can cancel the hashing operation at any time by pressing the
[Cancel]
soft key.
If the source disk has an HPA-protected region, the TD2u automatically disables the HPA
before performing the hash calculation. This is the same behavior is exhibited by the
TD2u during duplication. If you compare the hash values produced when duplicating a
disk and when using the
Hash Utilities
, you should get the same hash results.
When the hashing operation is finished, the TD2u screen displays the hash results.
