OPENTEXT Tableau Forensic TD2u User Manual Download | Manualshive

Page: 42 / 47

background image

42

The Information Company

Problem

Corrective Action

TD2u does not detect SATA

hard disk

Use only the 8" TC3-8 SATA cable provided by Tableau. With

some SATA hard disks, the SATA connector might be loose.

Ensure that the TC3-8 cable is seated properly in the SATA

connector of the hard disk.

Tableau has tested the TD2u with an extensive in-house library of different hard disks

spanning many years of hard disk development, but there might be compatibility issues

with some hard disks. Tableau issues firmware updates to address most compatibility

issues. If your hard disk is not recognized by the TD2u, check the Support pages on the

Tableau web site (

security.opentext.com

) to see if any firmware updates are available for

the TD2u.

5.1.3 Problems with encrypted drives

Prior to TD2u v1.3 release in December 2017, the method by which 4kbyte sector size

drives were encrypted was not compatible with the VeraCrypt standard. This would result

in an inability to properly decrypt a TD2u encrypted 4k drive on any system using the

publicly available VeraCrypt application. Drives with 512 byte sector sizes and advanced

format drives (4kbyte drives that act as 512 byte drives) were not affected by this issue.

This issue was fixed in TD2u v1.3 software. If you captured encrypted evidence on pre-

v1.3 TD2u software, that evidence will no longer be usable on a TD2u that has been

updated to v1.3 or later. Such a drive would be able to be unlocked, but the unlocked

data container would present unintelligible information to the system. In that scenario, if

the improperly encrypted 4k drive was attached to a TD2u destination port, no filesystem

would be detected and the TD2u would prompt to format the drive during Duplication

setup. That format request should be declined in order to preserve the previously

captured evidence.

In order to recover the previously captured evidence, the v1.3 firmware includes a

“Legacy Unlock” feature. If you have such a drive, the following procedure will allow for

recapture of the previous evidence:
1.  Update your TD2u to version 1.3 or newer.
2.  Connect the encrypted, 4k sector drive to the appropriate source port on the TD2u.
3.  Connect a different drive to one of the destination ports of the TD2u. This drive must

be big enough to store the entirety of the 4k source.

4. Boot the TD2u.
5. Go to the Disk Info screen for the 4k source and select the Legacy Unlock (VERY

RARE) option. This option will only be present for encrypted 4k drives. It will guide

you through a familiar unlock process and instruct the TD2u to use the encryption

style the 4k drive is using.

«
...
40
41
42
43
44
...
»

Summary of Contents for Tableau Forensic TD2u

Page 1: ...OpenText Tableau TD2u Forensic Duplicator User Guide The Information Company ...

Page 2: ... 10 3 4 User selected startup mode 10 3 5 System Settings Menu 7 1 10 3 6 Set Examiner Name Menu 7 1 2 13 3 7 Imaging Setup Menu 7 2 13 3 7 1 Error recovery modes 16 3 8 Factory Reset Menu 7 3 16 3 9 Duplicator Info Menu 8 16 3 10 Connecting hard drives 17 3 11 Drive detection 18 4 Using the TD2u 19 4 1 Overview 19 4 2 TD2u menus and options 19 4 3 Duplicate Menu 1 20 4 3 1 Initiating a duplicatio...

Page 3: ...nformation 33 4 10 Logs menu Menu 6 34 4 10 1 View Logs Menu 6 1 34 4 10 2 Save All Logs Menu 6 2 37 4 10 3 Delete All Logs Menu 6 3 38 4 10 4 Print All Logs Menu 6 4 38 4 11 Resetting and clearing internally stored information 38 5 Troubleshooting and support 40 5 1 Troubleshooting common problems 40 5 1 1 Power supply issues 40 5 1 2 Problems with disk detection 41 5 1 3 Problems with encrypted ...

Page 4: ...oft key labels are indicated with square brackets For example Select indicates that Select is displayed above a soft key on the display 1 3 Disk capacity and transfer rate measurement conventions The computer industry generally adheres to two different conventions for the definitions of the terms megabyte MB and gigabyte GB For computer RAM 1 MB is defined as 220 1 048 576 bytes and 1 GB is define...

Page 5: ...ingerprints Native support for USB 3 0 SATA and IDE hard disks from the source interface Parallel duplication to two SATA and one USB 3 0 destination hard disks Parallel image and clone duplication Optional destination disk encryption to ensure security of imaged source data Detailed log generation for case documentation Automatic blank checking of source and destination drives HPA DCO and AMA sup...

Page 6: ... for use with the TP5 NC power supply When shipped to other geographic markets the local reseller typically adds an AC line cord appropriate for the local market TC2 8 R2 Hard disk power cable to connect IDE and some legacy style SATA hard disks to the TD2u 3M to Molex TC3 8 SATA signal cable to connect SATA hard disks to the TD2u TC4 8 R2 SATA SAS power signal cable to SAS and 3M power 2 pieces T...

Page 7: ...by Tableau you can buy a hard sided case and reuse the foam insert directly in that case 2 3 Navigating the TD2u When using the TD2u you may be prompted to enter certain information into the display Use the up down left right arrow keys and the center button to select values While you are entering information the TD2u displays two soft key functions at the bottom of the LCD display The soft keys p...

Page 8: ...TD2u displays the date and time As you navigate the TD2u menu structure the menu item number displays in the upper left hand corner For example the Disk Utilities menu is Menu 5 the Format menu is Menu 5 1 the Hash menu is Menu 5 2 and so on These menu numbers help you navigate the menu hierarchy The TD2u ships with a Quick Start card illustrating the layout of the display buttons connectors and s...

Page 9: ...any of the USB ports on the front and back of the TD2u Using a keyboard for data entry can be faster and more convenient than using the arrow keypad on the TD2u When using a USB keyboard the Enter key on the keyboard generally corresponds to the right soft key on the TD2u The Esc escape key on the keyboard generally corresponds to the left soft key If your keyboard has arrow keys or a mouse like i...

Page 10: ...p Mode setting provides the following options Main Menu Duplication for cloning or imaging Wipe Disk You can configure the startup mode and other settings at any time from the System Settings menu Menu 7 1 Once you have configured your TD2u the startup sequence bypasses the Configuration Wizard unless you have used Factory Reset Menu 7 3 in the Setup menu 3 4 User selected startup mode The TD2u ca...

Page 11: ...haracter del The up and down arrows select the desired alphabetic character The center button on the arrow keypad enters a letter or selects the delete function Once you have set the desired name press the Save soft key to record your changes See below for more details Set Date Time Numeric NA The Date and Time option lets you set or change the time stored by the real time clock in the TD2u The an...

Page 12: ... of time This Drive Shutdown Delay setting represents the length of time from job task completion to when the drive is shutdown or put into standby mode If the Off option is chosen no drives will be shutdown or put into standby mode To change this setting simply scroll to the desired shutdown delay duration and hit Select This drive shutdown feature applies to the following jobs tasks and drive in...

Page 13: ...etters lowercase letters and numbers use the Up and Down buttons to scroll through characters Press the center button on the keypad to select a character To delete the last character you entered select del from the keypad To clear all text use the right arrow to move to the del item and press the up or down arrow This should change del to clr Selecting this by pressing the center button clears all...

Page 14: ...ompromising data Directory Name Date Time Serial Number Model and Serial Manual Date Time Specifies the directory name for the imaging operation Date Time generates a directory name of the form yy mm dd hh mm ss that corresponds to the date and time when the duplication started Custom Filename Prompt Skip Prompt When set to Prompt the user is prompted to enter the filename When set to Skip the def...

Page 15: ...r Retry Count Zero One Ten 100 One Specifies the maximum number of errors allowed on each operation on the source drive Image Verification No Verification Verify Prompt Prompt Specifies if at the end of an imaging operation the TD2u should automatically perform a hash verification of the destination s prompt the user or do no verification at all Wipe Type Single Pass Multiple Pass Secure Erase Sin...

Page 16: ...error recovery modes the TD2u handles unreadable sectors in the same way When the TD2u has determined that a sector cannot be read from the source drive it fills in the missing data with zeros on the destination drive Zero data inserted in this way is also included by the TD2u when calculating the MD5 SHA1 and SHA 256 hashes for the duplication The TD2u treats all media errors on a destination dis...

Page 17: ...te Jun 4 2019 The build date of the TD2u firmware release 3 10 Connecting hard drives Viewing the front of the TD2u the source drive attaches to the left side of the duplicator and the destination drive s attach to the right side The following procedure provides the steps for connecting hard disks to the TD2u This procedure applies to typical 3 5 SATA and IDE hard disks To connect hard disks to th...

Page 18: ...eft The green Power LED indicates that the duplicator is turned on Note When connecting an IDE source disk to the TD2u always connect the blue end of the IDE cable TC6 2 or TC6 8 to the TD2u and the black end to the hard disk If using other than a Tableau supplied cable ensure that the colored stripe on the cable aligns with Pin 1 on the hard disk Failure to do so can result in unreliable communic...

Page 19: ...vigate the menu tree These numbers also make it easy to refer back to this guide for detailed information The following outline provides the menu structure Main Menu Sub menu 1 Duplicate none 2 Wipe none 3 Encryption 3 1 Encrypt New Destination 3 2 Unlock Destinations 3 3 Change Dest Password 4 Disk Info 4 0 SATA Source Info 4 1 IDE Source Info 4 2 USB Source Info 4 3 SATA Dest 1 Info 4 4 SATA Des...

Page 20: ...sector by sector to a destination disk Source disk sector one is copied to destination disk sector one then sector two is copied to sector two sector three to sector three and so on Imaging also known as disk to file duplication is the process of copying a source disk to a series of files on destination disks Note Starting with TD2u firmware version 1 3 the selection of clone or image for a specif...

Page 21: ... Case Notes and Case ID Note If mistakes are made in data entry leading up to the start of a new duplication job the Back button can now be used to make changes before proceeding Earlier versions of TD2u software required cancelling the job setup and starting over 5 Press the Start soft key to initiate the duplication process 6 If applicable based on Imaging Setup settings select Verify or No Veri...

Page 22: ... for each separate acquisition If an acquisition spans multiple destination disks the same directory name is used on each destination disk This makes it easy to group image files related to a particular acquisition The directory name can be auto generated by the TD2u or you can enter it yourself Auto generated names can be based on the date time the serial number of the source device or the model ...

Page 23: ...urce disk The TD2u does not automatically remove DCO or AMA on the source disk as doing so requires a permanent modification of the source disk You can cancel the duplication and manually remove the DCO or AMA using the Disk Utilities option under the Main menu Source Fits into Destination Both Fatal Warning For Clone destinations the destination disk must be at least as large as the source disk F...

Page 24: ...e blank the TD2u formats it without any warnings Destination Block Size Clone Warning When performing a Clone duplication differences in the block size between the source and destination drive may result in a clone drive not being intelligible to other host systems This is because any existing source drive partition tables and or filesystems will contain block size specific information that will b...

Page 25: ...f zeros 00h to the destination drive in a single pass The TD2u will display on screen performance and timing metrics during the wiping process You can cancel the wiping operation at any time by pressing the Cancel soft key Note The TD2u will not automatically overwrite a DCO or AMA on the destination drive 4 5 2 Multi pass wipe The TD2u performs three write passes on the destination drive The firs...

Page 26: ...tware hardware and knowledge of the password used for encryption On Windows the publicly available open source program VeraCrypt can read disks encrypted by TD2u However drives encrypted first by VeraCrypt likely cannot be used by TD2u without re encryption See security opentext com for more information about whole disk encryption used by TD2u including details about the exact algorithms used and ...

Page 27: ...rive or drives to be encrypted This password is required each time you want to access the data on the destination read or write If the encryption header set up by Encrypt New Destination is overwritten the encrypted data is permanently lost See the OpenText website for more information on the methods and algorithms used for TD2u encryption Securely encrypting destinations takes 15 to 20 seconds 4 ...

Page 28: ...ot change the encryption across the drive Generating a new secure header takes 15 to 20 seconds 4 7 Disk information Menu 4 The TD2u can display detailed information about the source or the destination hard disk s From the Disk Info Menu 4 0 screen select any drive attached to a source or destination port The following table lists the disk information displayed by the TD2u ...

Page 29: ...Model name reported by the hard disk Serial S21CNXAG707236T Serial number reported by the hard disk USB Serial 3 ADD USB Devices Only Serial reported over USB which may be different than the serial number Revision 3 AAD Firmware revision reported by the hard disk Capacity 40 0 GB Capacity of the hard disk as it will be copied used by the TD2u Reported Capacity 20 000 000 Capacity in sectors as rep...

Page 30: ...T32 The FAT32 file size limit is 4 GB The exFAT file size limit is 16 EB 16 000 000 TB When file sizes are larger than 4 GB exFAT should be used From the formatting menu you can manually format either the destination disk or a USB mass storage device attached to one of the TD2u USB ports 1 From the Main menu use the arrow keys to navigate to Disk Utilities Menu 5 and then to Format Menu 5 1 2 Sele...

Page 31: ... the TD2u If a destination disk is unformatted and not blank the TD2u prompts you to format the disk before it begins the duplication If a destination disk is unformatted and appears to be blank the TD2u automatically formats it The TD2u only formats disks using ExFAT however disks that have been preformatted with FAT32 can be used on the system FORMAT USB ACCESSORY MENU 5 1 2 The Format USB Acces...

Page 32: ...ure sets Note Starting with the ACS 3 ATA ATAPI Command Set 3 specification update the concept of Accessible Maximum Address AMA was introduced as a way to create hidden data regions on drives Drives that support AMA do not support HPA DCO and vice versa While somewhat rare some drives do support this new AMA method of limiting the reported drive capacity and it should be kept in mind during digit...

Page 33: ...Instantaneous Transfer Rate bytes per second minute Current Rate xxx MB unit The average transfer rate over the last five seconds Elapsed Time Elapsed Time min sec Total elapsed time since the start of the current task Time Remaining Time Remaining min sec Estimated remaining time for the current task This time is calculated using the amount of data remaining divided by the average transfer time A...

Page 34: ...apacity to store approximately 59 of the most recently logged operations Once the TD2u has stored 59 log entries the creation of a new log entry will automatically overwrite the oldest log entry The Logs Options menu lets you view print save and erase log entries 4 10 1 View Logs Menu 6 1 Selecting the View Logs option displays a list of the logs currently recorded in the internal flash memory of ...

Page 35: ...AMPLE TD2U LOG The TD2u maintains detailed logs for each task initiated by the user Here is a sample of an error free log for a 1 3 Disk Duplication job Start of TD2u Log Entry Task Disk Duplication Status Ok Created Wed Jul 17 14 54 45 2019 Started Wed Jul 17 14 54 45 2019 Closed Wed Jul 17 15 00 25 2019 Examiner QA Test Case ID Example Case Notes Example Imager App TD2u Imager Ver 2 0 0 build aa...

Page 36: ...000115 Capacity in Bytes 120 034 123 776 120 0 GB Block Size 512 bytes Block Count 234 441 648 Power ON Block Count 234 441 648 HPA In Use No HPA Block Count 234 441 648 DCO In Use No DCO Block Count 234 441 648 Encrypted No Destination Type Image USB Dest Interface USB Model SanDisk Extreme Pro Firmware Revision 0 Serial Number 13D987654321 USB Serial Number 123456789D31 Capacity in Bytes 128 043...

Page 37: ...18271D61EABC Verification MD5 be0ff9ed3e879f79bc9aa6ca01c13517 Verification SHA 1 69d148c9394c59b93ebb634ee2dacf81ca68edb5 Verification SHA 256 50bcb437813b135ae8dfe69cd6505c66bb72b118ce4b521dba2d69c25e6511c5 Status Verified End of TD2u Log Entry If the TD2u had detected any bad sectors on the source drive it would have added a section at the end of the TD2u log This additional section would list ...

Page 38: ...bed below The first non volatile memory is a flash device which is used to store the firmware and serial number of the TD2u The firmware can be updated using the Tableau Firmware Update utility available from security opentext com This flash device is never used to record any user specific or acquisition specific information The second non volatile memory is a separate flash device used to store t...

Page 39: ...Update program which can be downloaded from security opentext com TD2u serial number None It is not possible to change the TD2u serial number in the field Flash 2 TD2u configuration User specific All configuration settings can be erased and restored to factory defaults by selecting Setup Factory Reset Configuration settings excluding user name and startup mode can be reset to defaults using Setup ...

Page 40: ...pply issues The TP5 power supply provided with the TD2u when used with the appropriate adapter for the TD2u is a 15 volt power supply that uses a barrel connector to interface with the TD2u It is capable of powering the TD2u and nearly all combinations of one two or three SATA hard disks The TD2u also employs staggered power sequencing for the source and destination hard disks With staggered seque...

Page 41: ...be connected to the TD2u using either the 8 TC6 8 IDE cable or the 2 TC6 2 cable In either case the blue end of the IDE cable must be connected to the TD2u You must not use an IDE cable longer than 8 with the TD2u Always use the Tableau provided high quality 80 conductor TC6 8 or TC6 2 cable Drive power and signal must be attached before the TD2u is powered on TD2u does not detect notebook IDE har...

Page 42: ...y this issue This issue was fixed in TD2u v1 3 software If you captured encrypted evidence on pre v1 3 TD2u software that evidence will no longer be usable on a TD2u that has been updated to v1 3 or later Such a drive would be able to be unlocked but the unlocked data container would present unintelligible information to the system In that scenario if the improperly encrypted 4k drive was attached...

Page 43: ...with a backup battery The battery has a shelf life of 12 18 months If you use the TD2u regularly expect the battery to last longer than 18 months As the battery discharges the TD2u displays a low battery warning message This section provides an illustrated procedure for replacing the RTC backup battery 5 2 1 Compatible batteries The TD2u uses an ANSI NEDA type 5012LC battery The following table li...

Page 44: ...wn in the pictures below Hold one of the 3M power connectors one each side This will allow the PCB Printed Circuit Board to stay with the top of the case when the bottom is removed 5 The fan used in the TD2u is attached to the lower half of the plastic case Carefully lift the lower half of the case away from you 6 Set the TD2u on a flat surface as shown below So as to not stretch or disconnect the...

Page 45: ...OpenText Tableau TD2u Forensic Duplicator The Information Company 45 The backup battery is near the heatsink as shown in the photograph below ...

Page 46: ...that hold the TD2u case together also secure the main circuit board After replacing the four case screws inspect the TD2u to ensure the case is tightly secured 5 2 3 Testing the new battery After you have securely fastened the TD2u case return it to its normal upright position and attach just the TP5 power supply Turn the TD2u on and observe the startup sequence You should not see a battery warnin...

Page 47: ...OpenText OpenText enables the digital world creating a better way for organizations to work with information on premises or in the cloud For more information about OpenText NASDAQ TSX OTEX visit opentext com Connect with us OpenText CEO Mark Barrenechea s blog Twitter LinkedIn ...

Reviews:

No comments

Related manuals for Tableau Forensic TD2u

Brand: Riso Pages: 362

DIRECTOR series

Brand: MF DIGITAL Pages: 8

Brand: MF DIGITAL Pages: 73

Brand: Disc Makers Pages: 13

Brand: Disc Makers Pages: 45

Brand: Disc Makers Pages: 50

Brands by name

0 1 2 3 4 5 6 7 8 9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Popular brands

Load more brands