Tableau Disk Monitor Users` Guide

Tableau Disk Monitor Users` Guide
TD1 Forensic Duplicator
Users’ Guide
Tableau, LLC
N8 W22195 Johnson Drive, Suite 100
Waukesha, WI 53186
www.tableau.com
© 2008-09 Tableau, LLC. All rights reserved.
Tableau is a registered trademark of Tableau, LLC.
Table of Contents
1.
INTRODUCING THE TD1 FORENSIC DUPLICATOR ................................4
2.
HOW TO USE THIS MANUAL.....................................................................4
2.1
2.1.1
2.1.2
3.
3.1.1
3.1.2
3.1.3
3.1.4
3.2
3.2.1
3.2.2
4.4.1
4.4.2
4.5
4.5.1
Turning ON Your TD1 for the First Time .................................................................... 8
Learning to Navigate the TD1 Screens & Menus....................................................... 8
The Source is on the Left! ........................................................................................ 10
Connecting Source and Destination Hard Disks ...................................................... 11
Common Tasks .............................................................................................. 12
Duplication................................................................................................................ 12
Wiping Destination Disks.......................................................................................... 13
TD1 Startup Sequence ................................................................................... 14
Progress Displays During Duplication, Wiping and Hashing .......................... 16
Conditions Checked Before Duplication ......................................................... 17
File Structure and Naming Conventions ......................................................... 19
Disk-to-File Duplication ............................................................................................ 19
Saving Logs to a USB Storage Device .................................................................... 20
Information Stored Internally by the TD1 ........................................................ 21
Resetting/Clearing Information Stored Internally by the TD1................................... 22
REFERENCE .............................................................................................23
5.1
5.1.1
5.1.2
5.1.3
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
6.
Unpacking your TD1 Kit.................................................................................... 6
USEFUL INFORMATION...........................................................................14
4.1
4.2
4.3
4.4
5.
Conventions for Disk Capacity and Transfer Rates ................................................... 5
The Alert LED ............................................................................................................. 5
QUICK START.............................................................................................6
3.1
4.
Conventions Used In This Manual.................................................................... 5
Physical Layout & Controls............................................................................. 23
LEDs......................................................................................................................... 23
Buttons ..................................................................................................................... 23
LCD Contrast............................................................................................................ 24
Menus and Options ........................................................................................ 25
Duplicate Disk........................................................................................................... 26
Format ...................................................................................................................... 29
Wipe Disk ................................................................................................................. 30
Hash Utilities............................................................................................................. 31
Blank Check ............................................................................................................. 32
Disk Information........................................................................................................ 33
Disk Utilities .............................................................................................................. 35
Logs.......................................................................................................................... 36
Setup ........................................................................................................................ 38
TROUBLESHOOTING AND SUPPORT....................................................44
6.1
6.1.1
6.1.2
6.1.3
6.2
Troubleshooting Common Problems .............................................................. 44
Power Supply Issues................................................................................................ 44
Problems with Disk Detection................................................................................... 44
Real-Time Clock / Battery ........................................................................................ 46
Support ........................................................................................................... 47
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 2
APPENDIX A. BATTERY REPLACEMENT .......................................................48
A.1
A.2
A.3
A.4
A.5
A.6
Compatible Batteries ...................................................................................... 48
Tools Required ............................................................................................... 48
Opening the TD1 ............................................................................................ 49
Locating and Replacing the Battery................................................................ 51
Re-Closing the TD1 ........................................................................................ 51
Testing the New Battery ................................................................................. 52
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 3
1. Introducing the TD1 Forensic Duplicator
The Tableau TD1 is a "forensic duplicator". As a forensic duplicator, the TD1 has many of the functions
traditionally found in duplicators for the general IT market. In addition, the TD1 has features and
capabilities that make it very good at handling the special needs of forensic practice.
Like any good IT duplicator, the TD1 is very fast, sustaining data rates up to 6 GB/minute. The TD1 is
also versatile, having native support for both SATA and IDE hard disks on both the input (source) and
output (destination) interfaces.
The TD1 also has features uniquely valuable in forensic applications. One of the most important of these
features is the ability to calculate MD5 and SHA-1 hash values – sometimes called fingerprints – for the
data being duplicated without slowing the duplicator. Other forensic features include detailed log
generation (useful for case documentation), automatic blank-checking of source and destination drives,
detection and handling of hidden/protected data areas on source and destination drives (HPA & DCO
support), and so forth.
These pages contain a wealth of information about the Tableau TD1 Forensic Duplicator. We hope you
find this information useful and informative as you work with the TD1.
2. How to Use This Manual
This manual is divided into four main sections:
Quick Start. Quick information for setting up and using the TD1.
Useful Information. Highlights key areas worth understanding when using the TD1.
Reference. A detailed, menu-by-menu guide to the operation of the TD1.
Troubleshooting and Support. Ways to resolve common problems.
We suggest you begin with the Quick Start and Useful Information sections. These sections are shorter
than the complete Reference, and will generally give you enough information to get started with the TD1.
When you are ready to understand the TD1 in more detail, the Reference section will give you detailed
information about the many capabilities of the TD1.
The Troubleshooting and Support section is a brief list of solutions for common problems when using the
TD1. However, if you find yourself having trouble with the TD1, please visit the Tableau web site
(www.tableau.com) where you will find up-to-date guidance and answers to frequently asked questions.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 4
2.1 Conventions Used In This Manual
While reading this manual please pay special attention to text highlighted using the following convention.
IMPORTANT: Paragraphs in bold italics make important points.
Hint: Sometimes paragraphs in bold italics highlight information and tips for getting the best
performance from your Tableau TD1 Forensic Duplicator.
This manual also highlights critical points with an exclamation mark in a yellow triangle.
Highlights an important point or caution. You won't find this symbol very often in this
manual. When you do, it means there is an especially important point which you must
understand in order to use your Tableau TD1 properly.
The TD1 has two "soft keys" placed immediately under the LCD display. The bottom (i.e., fourth) line of
the LCD will have text indicating the current function for each of the two soft keys. In this manual the text
is surrounded by square brackets. For example, [Select] indicates the soft key with the word "Select"
displayed above it on the LCD.
2.1.1 Conventions for Disk Capacity and Transfer Rates
In the computer industry there are two conventions for the meaning of terms like "megabyte" and
20
"gigabyte". When talking about devices like computer RAM, one megabyte is traditionally equal to 2 =
30
1,048,576 bytes and one gigabyte is traditionally equal to 2 = 1,073,741,824 bytes.
However, when talking about disk storage, disk manufacturers have traditionally referred to one
megabyte as 106 = 1,000,000 bytes and one gigabyte as 109 = 1,000,000,000 bytes.
To make matters more complicated, Microsoft operating systems such as Microsoft Windows have
traditionally measured disk capacity using the "powers-of-two" convention typically used for RAM while
the Apple Macintosh operating systems have traditionally measured the same disk capacities using the
"powers-of-ten" convention.
When referring to disk capacities and disk transfer rates, Tableau has adopted the convention traditionally
used by disk manufacturers. So, when Tableau displays a number on screen such as "4 GB" this should
be interpreted as 4,000,000,000 bytes. Similarly, when Tableau refers to the TD1's peak transfer rate of
"100 MB/sec" this should be interpreted as 100,000,000 bytes per second.
2.1.2 The Alert LED
The TD1 has a yellow Alert LED. By convention the TD1 will flash the yellow Alert LED whenever the
units requires user intervention.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 5
3. Quick Start
3.1 Unpacking your TD1 Kit
The TD1 is shipped in a complete kit which includes cables, adapters, and a power supply which should
satisfy most of your day-to-day forensic imaging requirements.
When you first receive your TD1, please unpack the kit and familiarize yourself with its contents. The
following table lists each of the items found in the kit.
Product Photo
Tableau
Model #
Description
TD1
Duplicator main unit.
TP3-NC
High-output power supply for use with TD1. The TP3 provides
enough power to supply the TD1 and most common
combinations of source and destination hard disks. The TP3
uses a universal 2-pin AC line cord and is compatible with 110240VAC line voltages worldwide.
TP2-LC-US
When shipped to markets in North America the kit includes the
TP2-LC-US AC line cord for use with the TP3-NC power
supply. When shipped to other geographic markets, the local
reseller typically adds a 2-pin AC line cord which is appropriate
for the local market.
TC2-8
"Molex-style" power cable (2 pcs). Power cable to connect IDE
hard disks and older, legacy style SATA hard disks to the TD1.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 6
TC5-8
"SATA-style" power cable (2 pcs). Power cable to connect the
15-pin SATA power connector found on most modern SATA
hard disks to the TD1.
TC3-8
SATA signal cable (2 pcs). Signal cable to connect SATA hard
disks to the TD1.
TC6-8
IDE signal cable (2 pcs). Signal cable to connect IDE hard
disks to the TD1.
Do not use the TC6-8 IDE cable to connect
notebook drive adapters to the TD1. Instead, use
the shorter TC6-2 IDE cable (below).
TC6-2
IDE signal cable for notebook drive adapters. Signal cable to
connect notebook drive adapters to the TD1.
TDA5-25
Adapter for 2.5" notebook hard disks.
TDA5-18
Adapter for 1.8" notebook hard disks.
TKDA5-ZIF
Adapter kit for 1.8" "ZIF-style" notebook hard disks.
TC7-6-6
6-pin FireWire/1394 signal cable. Used to connect the TD1 to
a host computer for firmware updates.
TQS-TD1
Quick Start card for TD1 kit.
Don't overlook or discard the foam packaging! The foam packaging in the TD1 kit is
designed to fit several industry-standard hard-sided carrying cases. So, if you received the
TD1 kit in the cardboard box shipped by Tableau, you can buy a hard-sided case and re-use
the foam insert directly in that case.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 7
3.1.1 Turning ON Your TD1 for the First Time
Your TD1 will be in the "factory reset" state when you first receive it. After you have unpacked your TD1
for the first time, connect it to the TP3 power supply and turn it ON. You do not need to connect any hard
disks to the TD1 at this point.
When the TD1 is turned ON for the first time it runs a "Configuration Wizard" which prompts the user to
enter defaults for several configuration items 1 . (The TD1 stores your responses in flash memory, so you
will need to enter this information only one time.)
•
•
•
Your user name (see Section 5.2.9.1)
The current date and time (see Section 5.2.9.2)
The TD1 startup mode (see Section 5.2.9.3)
Your user name and the current date/time are recorded in TD1 logs each time you perform a task with the
duplicator. "Tasks" and TD1 logging are discussed more fully in a later section.
The startup mode is a unique feature of the TD1. With this feature you can select the default power-ON
behavior of the TD1, customizing the unit for your particular work flow. At present there are three options.
The TD1 can be configured to go directly to one of two duplication modes (either disk-to-disk or disk-tofile) or directly to the Main Menu. If your workflow typically involves a lot of duplication, then set either the
disk-to-disk (cloning) or disk-to-file (imaging) mode. If you prefer to start at the Main Menu, then set that
option instead.
Don't worry if you enter the wrong information through the Configuration Wizard! These three items and
many other TD1 defaults and settings can be configured through the Setup Menu at any time.
3.1.2 Learning to Navigate the TD1 Screens & Menus
As you are prompted for each item by the Configuration Wizard, use the up/down/left/right arrow keys and
the center button to select values.
As you are entering information you will also notice that the
TD1 displays "soft key" functions at the bottom of the LCD
display. There are two soft keys (left and right).
The function of the soft keys depends on the current context.
Sometimes the soft keys will have functions like [Back] and
[Next] (as they do during the Configuration Wizard). At other
times the soft keys may select items like [Cancel] and [Ok], etc.
Hint: Here is a useful way to think about the functions of the
different buttons on the TD1. The soft keys perform major
actions, like selecting a task, cancelling a function, or
moving between different display screens. The arrow
keypad is typically used to navigate within a given
screen/menu.
1
The TD1 also starts the Configuration Wizard after it has been returned to the "factory default"
state through the Factory Reset option in the Setup Menu.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 8
As a convenience, the center button on the arrow keypad also acts like a "Select" button when navigating
among TD1 menus. However, the center button on the keypad can never be used to start a "major task"
(i.e., duplication, disk wiping, etc.). To start a "major task" you must always use the soft key marked as
[Select] or [Start].
When you are viewing the Main Menu you will notice that the upper left corner of the display alternates
between the date and time. Once you descend into a specific menu you will notice that the date and time
is replaced with a menu number. For example, the "Duplicate" Menu is menu #1. As you descend further
into the TD1's menu structure you will see additional menu numbers appear in the upper left corner. For
example, "Disk-to-File" duplication is menu 1.2 (menu #1, sub-menu #2).
These menu numbers will help you keep track of where you are in the menu system as you navigate up
and down through the menu hierarchy. This manual references the same menu numbers to make it
easier for you to cross reference information in this manual with on-screen displays.
The TD1 is shipped with a Quick Start card. The Quick Start card illustrates the layout of the display,
buttons, connectors, and switches found on the TD1. We encourage you to keep the Quick Start card
with you as you familiarize yourself with the operation of the TD1.
In designing the TD1 Tableau made an effort to keep the user interface as simple and intuitive as
possible. We think you will find the combination of the soft keys and the arrow keypad to be quite natural
after a few minutes of use.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 9
3.1.3 The Source is on the Left!
The first question asked by many users is "which side is the source"? When looking at the TD1 from the
front, the source drive should always be attached to the left side of the duplicator and the destination
drive should be attached to the right side of the duplicator.
If you look at the front of the TD1 you will notice seven light emitting diodes (LEDs). An eighth LED is
located on the rear edge of the TD1 near the DIN-style power connector.
Two of the LEDs on the left are marked "SATA Source" and "IDE Source" and two of the LEDs on the
right are marked "SATA Dest" and "IDE Dest". These markings will help you remember that the source
drive is always connected to the left side of the TD1 and the destination (dest) drive is always connected
to the right side.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 10
3.1.4 Connecting Source and Destination Hard Disks
Like Tableau's forensic bridges (also known as "write blockers"), the Tableau TD1 should be turned
OFF when connecting and disconnecting hard disks. There is one exception to this rule…When
imaging (disk-to-file duplication), the destination disk may become full. When this happens, the TD1
will turn OFF the destination disk and ask you to connect a new/different destination disk. You
should not turn the TD1 OFF during this process.
Step-by-step instructions for connecting hard disks to the TD1:
1. Confirm that the TD1 power switch is in the OFF position (the Power LED will be OFF).
2. Connect one source disk to the TD1 using the appropriate signal cable.
a. TC6-8 IDE signal cable 2 or
b. TC3-8 SATA signal cable
3. Connect the source disk to the TD1 source power using the appropriate drive power cable.
a. TC2-8: IDE / SATA drive power cable or
b. TC5-8: SATA drive power cable
4. Connect one destination disk to the TD1 using the appropriate signal cable.
a. TC6-8: IDE signal cable2 or
b. TC3-8: SATA signal cable
5. Connect the destination disk to the TD1 destination power using the appropriate drive power cable.
a. TC2-8: IDE / SATA drive power cable or
b. TC5-8: SATA drive power cable
6. Connect the TP3 power supply to the power connection located on the back of the TD1. Using the
appropriate line cord, plug your TD1 into an AC power source.
NOTE: The green DC Power In LED indicates that power is available at the power connector.
Toggle the TD1 power switch “ON” to power on the TD1.
NOTE: The green Power LED indicates that the duplicator is turned ON.
The TD1 is a 1-to-1 duplicator. When connecting hard disks to the TD1, never connect more than
one hard disk to each side of the TD1 at the same time.
The preceding instructions apply to typical 3.5" SATA and IDE hard disks. If you are connecting a 1.8" or
2.5" notebook hard disk to the TD1 you will need to use a TC6-2 IDE signal cable in conjunction with one
of the following notebook adapters:
a.
b.
c.
TDA5-18 1.8" notebook adapter
TDA5-25 2.5" notebook adapter
TDA5-ZIF 1.8" ZIF adapter and cables
TC20-3-2 ZIF cable for 0.2mm ZIF connectors
TC20-3-3 ZIF cable for 0.3mm ZIF connectors
IMPORTANT: You must use the shorter TC6-2 (2") IDE cable when connecting a notebook drive
adapter to any Tableau product, including the TD1. Never use the longer TC6-8 (8") IDE cable with
notebook drive adapters.
2
When using IDE signal cables, the blue cable connector must be plugged into the TD1 unit for
proper operation.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 11
3.2 Common Tasks
The following sections illustrate brief, step-by-step instructions for some of the most common tasks
performed using the TD1.
3.2.1 Duplication
You have purchased a high-performance duplicator, so it stands to reason that duplication will be one of
the most common tasks you perform with your TD1.
The TD1 can perform either of two types of duplication: cloning and imaging. Cloning is the process of
copying a source disk sector-by-sector to a destination disk. The first sector on the source disk is copied
to the first sector on the destination disk, the second to the second, and so forth. In the TD1 we refer to
this as "disk-to-disk" duplication. Imaging is the process of copying the source disk into one or more files
on the destination disk. In the TD1 we refer to this as "disk-to-file" duplication.
3.2.1.1 Cloning (Disk-to-Disk Duplication)
1. Follow the steps listed in Section 3.1.4 to connect the source and destination hard disks to the TD1
and turn on the TD1.
2. Starting with the Main Menu, navigate to Disk-to-Disk duplication (Menu #1.1).
3. Press the [Start] soft key to begin duplication.
4. On-screen displays report the progress of the duplication task. You may press the [Details] button at
any time during duplication to see more information about the duplication process.
5. When duplication finishes you may print or save a copy of the log.
Before beginning duplication the TD1 will check for situations which might require your special attention.
For example, the TD1 checks to make sure the destination disk is at least as large as the source disk. If
not, the TD1 will inform you of the problem and will not allow duplication to proceed. The TD1 performs a
number of other automatic tests before beginning duplication. A complete list of these tests is provided in
Section 4.3.
3.2.1.2 Imaging (Disk-to-File Duplication)
1. Follow the steps listed in Section 3.1.4 to connect the source and destination hard disks to the TD1
and turn on the TD1.
2. Starting with the Main Menu, navigate to Disk-to-File duplication (Menu #1.2).
3. Press the [Start] soft key to begin duplication.
4. On-screen displays report the progress of the duplication task. You may press the [Details] button at
any time during duplication to see more information about the duplication process.
5. When duplication finishes you may print or save a copy of the log.
Unlike Disk-to-Disk duplication, Disk-to-File duplication does not require that the destination disk be as
large as the source disk. The TD1 supports a feature called "spanning" which allows the destination data
to span more than one destination disk.
You do not need to format the destination disk before starting Disk-to-File duplication. If a destination
disk already has an acceptable format 3 , the TD1 will use it as-is. Otherwise, the TD1 will automatically
format each destination disk as needed. If a destination disk is not already formatted and if the disk does
3
As of this writing, the TD1 supports destination disks formatted for the FAT32 file system.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 12
not appear to be blank, the TD1 will prompt you to confirm that you want to format the disk. This helps to
prevent the unintended overwriting of disks.
3.2.2 Wiping Destination Disks
1. Follow steps similar to those listed in Section 3.1.4 to connect a destination disk. You do not need to
connect a source disk.
2. Starting with the Main Menu, navigate to the Wipe Menu (Menu #3).
3. Select "One Pass Write" or "Multi Pass Write".
4. Press [Yes] to confirm your selection.
5. On-screen displays report the progress of the wiping task.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 13
4. Useful Information
The following sections provide information regarding the operation and usage of the TD1 which you will
likely find useful.
4.1 TD1 Startup Sequence
Tableau designed the TD1 from the ground up to optimize it for the needs for forensic practitioners and
computer forensic processes. Because of this focus on forensics, users who are accustomed to using
duplicators from other vendors may find the TD1 usage model a little unfamiliar at first. However,
Tableau believes users will quickly come to appreciate the TD1's focus on efficiency.
Unlike duplicators from other vendors, the TD1 is designed to be turned OFF between acquisitions.
Turning the TD1 off between acquisitions minimizes the chances that users will inadvertently apply
power to a source or destination drive, possibly damaging a critical evidence device.
The following flowchart illustrates what happens when you turn ON the TD1.
Turn ON
Initialization
(~6 seconds)
Is Unit
Configured?
No
Configuration Wizard
Yes
Drive Detection
Yes
Yes
User Pressed
Menu?
No
Both Drives
Detected?
No
Yes
User-Selected Startup Mode
Main Menu
Disk-to-Disk
Duplication
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
Disk-to-File
Duplication
p. 14
Initialization. Immediately after power-ON, the TD1 begins an initialization and self-test procedure which
lasts approximately six seconds during which time the TD1 displays a copyright notice. If the TD1 detects
any faults, such as a low real-time clock battery or a power supply which is out of specification, it will
display warning messages at the end of initialization.
Configuration Wizard. If the TD1 is new, or if the user has erased all TD1 settings using the Setup →
Factory Reset option, then the TD1 will automatically start its Configuration Wizard. The Configuration
Wizard prompts for the user name, the current date and time, and the user's preferred TD1 startup mode.
Drive Detection. After initialization (or after the Configuration Wizard) the TD1 immediately begins drive
detection. During drive detection the user will see an on-screen display indicating whether source and
destination drives have been recognized properly. During this time the TD1 will also blink the "SATA" or
"IDE" LEDs for the source and destination sides of the duplicator.
The TD1 automatically detects the cable-type for the source and destination drives. If you are using a
SATA device, the corresponding "SATA" LED should be blinking. If you are using an IDE device, then the
corresponding "IDE" LED should be blinking.
At any time during drive detection you may press the "Menu" button to proceed immediately to the
TD1's Main Menu. . If you are performing a single-drive operation, such as formatting or wiping a
destination drive, then you should use the "Menu" button to proceed to the Main Menu after the
desired drive has been detected.
NOTE: The TD1 will continue drive detection in the background, even after you proceed to the Main
Menu. Drive detection stops when both source and destination drives have been detected or when
you start a single-drive task, such as destination disk wiping.
User-Selected Startup Mode. One of the novel features in the TD1 is the ability to select a default
startup mode. If you are typically using the TD1 for duplication, then set Disk-to-Disk or Disk-to-File as
your default startup mode. Immediately after detecting both source and destination disks the TD1 will
proceed automatically to the selected Duplication screen where you will have the option of pressing one
only one button to start the duplication. This feature gives you the ability to start typical duplication
operations very quickly and with minimum user input.
If instead of duplication you find yourself frequently using the TD1 for other operations such as disk
wiping or stand-alone hashing (hashing without duplication), then set "Main Menu" as your startup mode.
In this mode the TD1 will proceed immediately to the Main Menu after finishing drive detection. Again,
you can also proceed directly to the Main Menu at any time by pressing the [Menu] soft key which is
displayed during drive detection.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 15
4.2 Progress Displays During Duplication, Wiping and Hashing
During long disk operations including duplication, wiping, and stand-alone hashing, the TD1 displays
performance and timing metrics to help you observe and gauge the progress of the selected operation.
As of Firmware Revision 1.2, the TD1 displays five on-screen metrics. These metrics are displayed in a
rotating "loop". Each metric is displayed for approximately 2 seconds on the LCD line immediately above
the soft-key legends.
The following chart explains each of the performance/timing metrics displayed by the TD1.
Metric
Displayed As
Meaning/Description
Elapsed Time
"Elapsed: min sec"
Total elapsed time since the start of the
current task.
Time Remaining
"TimeRem: min sec"
Estimated remaining time for the current
task. This time is calculated using the
amount of data remaining divided by the
average transfer rate (see below).
Instantaneous Transfer Rate
(bytes per second)
"Instant: xxx MB/sec"
Instantaneous Transfer Rate
(bytes per minute)
"Instant: yyy GB/min"
The "instantaneous" transfer rate is
really the average over the most recent
6 seconds. This rate is displayed both
in bytes per second and bytes per
minute.
Average Transfer Rate
(bytes per minute)
"Average: yyy GB/min"
The "average" transfer rate is the
average rate since the start of the
current task.
Table 1. TD1 Performance and Timing Metrics
IMPORTANT: Rotating-media hard disks are faster at the beginning of the disk than they are at the
end of the disk. It is normal to see the "instantaneous" transfer rate at the beginning of the disk with
is 50 – 100% faster than the instantaneous transfer rate at the end of the disk. The difference in
speed from the beginning of the hard disk to the end is normal given the design of modern hard
disks and does not imply a problem with either the hard disks or the TD1 duplicator 4 .
4
Tableau has written a white paper explaining hard disk performance. This white paper,
Benchmarking Hard Disk Duplication Performance in Forensic Applications, is available for
download from Tableau's web site.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 16
4.3 Conditions Checked Before Duplication
In designing the TD1 for use in forensic applications, Tableau has paid special attention to conditions
which require exceptional handling by forensic practitioners. Before starting a Disk-to-Disk or Disk-to-File
duplication the TD1 automatically checks for a number of "preconditions". Some preconditions are
warnings, and the user can choose to continue or cancel after viewing each warning. Other preconditions
are fatal and require that the duplication process be aborted.
The following table summarizes preconditions checked by the TD1 prior to duplication.
Name
Disk-to-Disk
or
Disk-to-File
Type
Explanation
Source Disk
HPA
Both
Warning
Reports that HPA is in use on the source disk.
Note: HPA on the source disk is automatically removed by the
TD1. This warning gives the forensic practitioner an extra
"heads-up" to be aware that an HPA was present on the
source disk.
Source Disk
DCO
Both
Warning
Reports that DCO is in use on the source disk.
The TD1 does not automatically remove DCO on the source
disk as doing so requires a permanent modification of the
source disk. The user can cancel the duplication and
manually remove the DCO using the Disk Utilities option under
the Main Menu.
Destination Disk
HPA or DCO
Both
Warning
Reports that either HPA or DCO is in use on the destination
disk.
The TD1 does not automatically remove HPA or DCO on the
destination disk. This warning notifies the user that the
duplicator will not be using the total size of the destination
disk. The user can cancel the duplication and manually
remove the HPA / DCO using the Disk Utilities option under
the Main Menu.
Destination Disk
Too Small
Disk-to-Disk
Fatal
For Disk-to-Disk duplication the destination disk must be at
least as large as the source disk.
Chunk Size Too
Small
Disk-to-File
Fatal
For Disk-to-File duplication the "chunk size" must be large
enough so that the entire copy can fit in 999 chunks. The user
must specify a larger chunk size using the Setup → Duplicate
Optns menu.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 17
Source Disk May
Be Blank
Both
Warning
The TD1 checks selected sectors on the source disk looking
for non-blank data patterns. If all of the checked sectors
appear to be blank, the TD1 warns the user that the source
may be blank. This does not mean that the source is blank,
but it might mean that the source has been partially wiped or
that an ATA password has been set for the source drive.
Destination Disk
Is Not Blank
Disk-to-Disk
Warning
The TD1 checks selected sectors on the destination disk
looking for non-blank data patterns. If the destination disk is
not blank the user might be about to overwrite a disk
unintentionally, and this warning gives the user the chance to
abort the duplication.
Destination Disk
Is Not Blank
Disk-to-File
Warning
When performing Disk-to-File duplication the TD1 needs each
destination disk to be formatted with the FAT32 file system. If
the destination disk is already formatted for FAT32, the TD1
will use it as-is without overwriting any existing files. If the
destination disk does not have a FAT32 file system the TD1
can format it on the fly during duplication. If the destination
disk appears to be blank, the TD1 formats it without any
warnings. However, if the destination disk does not appear to
be blank, then the TD1 will issue a warning before formatting
it.
Duplication Will
Span Multiple
Destination
Disks
Disk-to-File
Warning
When performing Disk-to-File duplication the TD1 checks the
available space on the destination disk. If the destination disk
appears to be too small to receive the entire contents of the
source drive, then the TD1 will issue a warning giving the user
the opportunity to change disks or to proceed.
Destination File
System Nearly
Full
Disk-to-File
Warning
When performing Disk-to-File duplication the TD1 checks the
available space on the destination disk. If the destination disk
does not have enough room for a complete "chunk", then the
TD1 will pause and require the user to change destination
disks.
Table 2. Conditions Checked Before Duplication
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 18
4.4 File Structure and Naming Conventions
There are two situations in which the TD1 creates files on a destination disk:
1. When performing Disk-to-File duplication the TD1 writes copied data as a series of file "chunks". The
TD1 also writes a text file containing the log for the Disk-to-File operation.
2. When saving logs to a USB storage device the TD1 writes each log as a text file.
Note: As of the current firmware release, the TD1 supports only the FAT32 format for destination
disks and USB storage devices.
The following sections illustrate the directory and file naming conventions used in each of these
processes.
4.4.1 Disk-to-File Duplication
When performing Disk-to-File duplication (also known as "imaging") the TD1 creates files on the
destination hard disk which contain the data copied from the source hard disk. Each of these files is
called a "chunk".
Chunks are written to the destination disk according to the following convention:
(root dir)/
TD1_IMG/
YYMMDDhh.mm/
IMAGE.001
IMAGE.002
…
IMAGE.999
nnnnnD2F.LOG
"YYMMDDhh.mm" is a directory name which is generated using the date and time at which the
duplication started. So, if the duplication started on October 13, 2008, at 1:55 p.m., then directory name
would be "08101313.55".
"IMAGE.001" is the first chunk, or portion of the data copied from the source disk. The chunk size is a
user-settable option and may be specified under the Setup → Duplicate Optns menu. There may be a
maximum of 999 chunks for a single disk copy. If the user has specified a chunk size which would
require more than 999 chunks, the TD1 will report an error and abort the duplication process.
It is also possible to specify ".DMG" naming for chunks. .DMG refers to a file naming convention used by
Apple operating systems like OS X. If the .DMG naming option is selected the first chunk will be named
"IMAGE.DMG" instead of "IMAGE.001". All other chunks will have the same names (i.e., IMAGE.002,
IMAGE.003, etc.).
The first five characters – "nnnnn" of the .LOG file are generated from the internal log ID number
assigned to the log by the TD1. The "D2F" in the filename refers to the type of task, in this case a Diskto-File task. So, the first "chunk" will be written to the destination disk at a location like
"/TD1_IMG/08101313.55/IMAGE.001" and the log file might be called "00035D2F.LOG".
NOTE: If the Disk-to-File duplication spans more than one destination disk, then the directory
structure shown above will be reproduced on each destination disk. However, the .LOG file will be
written only to the "last" disk in the set.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 19
4.4.2 Saving Logs to a USB Storage Device
With TD1 REV 1.2 or later firmware it is possible to save logs to a mass storage device – like a thumb
drive – attached to one of the USB ports on the TD1. When the TD1 writes logs to a USB storage device
it adheres to the following directory and naming conventions:
(root dir)/
TD1_IMG/
LOGS/
SSSSSSSS/
YYMMDD/
nnnnnTTT.LOG
Here, "SSSSSSSS" is the "short-form serial number" for the duplicator itself. This eight-digit serial
number is the same as the serial number you will find printed on a label on the bottom of the TD1 itself.
"01D1000C" is an example of a valid TD1 serial number.
"YYMMDD" is a directory name which is generated using the date and time at which each log entry was
created. So, a log created on October 13, 2008, will be stored in a directory called "081013". If you are
saving logs which were generated on different days, then the TD1 will create multiple "YYMMDD"
directories under the "SSSSSSSS" directory.
As explained previously for Disk-to-File duplication, "nnnnn" is the internal log ID assigned by the TD1 for
each log entry. Finally, "TTT" is a 3-character code identifying the type of log entry as listed in the
following table:
3-Character Prefix
Type of Log Entry/Task
BCK
Blank Check
D2D
Disk-to-Disk Duplication
D2F
Disk-to-File Duplication
FMT
Disk Formatting (destination only)
HPA
HPA / DCO Operation
HSH
Disk Hashing (source only)
WIP
Disk Wiping (destination only)
Table 3. 3-Character Abbreviations for TD1 Tasks
Note: The 3-character codes in the above table match the 3-character codes displayed in the Logs →
View Logs menu.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 20
4.5 Information Stored Internally by the TD1
Some forensic and security applications require that the user be aware of the kinds of information which
can be stored by the duplicator. In some cases, users want to know what, if any information is preserved
by the unit from one acquisition to the next. In other cases, users in security-sensitive environments need
to be able to "sanitize" equipment before that equipment may be removed from a secure environment.
The TD1 has three separate non-volatile memories. The first non-volatile memory is a flash device which
is used to store the TD1's firmware and serial number. The firmware can be updated using the Tableau
Firmware Update utility (available from Tableau's web site). This flash device is never used to record any
user-specific or acquisition-specific information.
The second non-volatile memory is a separate flash device which is used to store two different types of
information: configuration settings and logs. Configuration settings include items such as:
•
•
•
•
User/operator name (entered via Configuration Wizard or Setup Menu).
Startup mode of operation (entered via Configuration Wizard or Setup Menu).
Error handling settings (error recovery strategy and error counter limits).
File settings for disk-to-file duplication (chunk size and chunk naming convention).
This second flash also records up to 59 of the most recent tasks performed by the duplicator. A "task" in
this context is any operation which operates on a disk device, including duplication, formatting, wiping,
hashing, blank checking, and HPA/DCO operations. Logs include detailed information about each disk
device attached to the TD1 including the make/model, serial number, capacity, and so forth.
The third and final non-volatile memory is the on-board real-time clock (RTC) with battery backup. The
real-time clock records the date and time as set by the user. The real-time clock does not record any
user-specific or acquisition-specific information.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 21
4.5.1 Resetting/Clearing Information Stored Internally by the TD1
There are several ways to reset/clear information stored internally by the TD1.
TD1 Non-Volatile
Memory
Information
Stored
User/CaseSpecific Info
How to Reset/Clear
Flash #1
TD1 firmware
None
Firmware can be updated using the Tableau
Firmware Update program which can be
downloaded from Tableau's web site.
TD1 serial number
None
It is not possible to change the TD1 serial
number in the field.
TD1 configuration
User-specific
All configuration settings can be erased and
stored to factory defaults by selecting Setup
→ Factory Reset.
Flash #2
Configuration settings (excluding user name
and startup mode) can be reset to defaults
using Setup → Duplicate Optns → Restore
Options.
TD1 logs
User-specific and
Case-specific
All logs can be erased by either selecting
Logs → Erase Logs or Setup → Factory
Reset.
Alternately, logs can be erased individually.
When viewing a specific log entry, select
the [Options] soft key, then select Erase
Log.
Real-Time Clock
Date/Time
None
The Date/Time cannot be restored to
factory a factory default state. However,
after performing a Factory Reset the TD1
prompts the user to change the Date/Time
within the Setup Wizard.
The Date/Time can also be changed by
selecting Setup → Date and Time.
Table 4. Non-Volatile Storage in the TD1
NOTE: The "Factory Reset" and "Erase Logs" options physically erase the flash memory
corresponding with each item. It is not possible to recover settings or log entries after the flash
memory has been physically erased.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 22
5. Reference
5.1 Physical Layout & Controls
5.1.1 LEDs
The following picture illustrates the location of each of the eight LEDs on the TD1.
5.1.2 Buttons
Use your keypad and soft keys to navigate TD1 screen displays:
Left Soft Key returns to a previous window or stops
/ cancels an activity, as defined by the on-screen
button label.
Right Soft Key selects a highlighted menu item
or starts / continues an activity, as defined by the
on-screen button label.
Select Key selects a highlighted menu item or
enters an examiner name character. Note: The
Select Key is never used to start activity. This key is
only used for menu navigation.
Vertical Arrow Keys scroll up or down and
highlight menu items for selection.
Horizontal Arrow Keys scroll left or right and
toggle between character lists.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 23
5.1.3 LCD Contrast
The following picture illustrates the front edge of the TD1 (the edge closest to the user).
Adjust the contrast of the TD1 LCD display using a small
Phillips screwdriver to rotate the contrast control located on
the front of your TD1.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 24
5.2 Menus and Options
The menus and screens in the TD1 are arranged in a tree structure. Under the Main Menu each branch
of the tree is numbered. These numbers will assist you in navigating the tree and in referring back to the
documentation in this manual. The following outline illustrates each of the menus.
Main Menu
1. Duplicate Disk
1.1 Disk-to-Disk
1.2 Disk-to-File
2. Format
2.1 Format Dest
2.1.1 Quick FAT32
2.2 Format USB
2.2.1 Quick FAT32
3. Wipe Disk
3.1 One Pass Write
3.2 Multi Pass Write
4. Hash Utilities
4.1 Hash Source
5. Blank Check
5.1 Source Disk
5.1.1 Quick Check
5.2 Dest Disk
5.2.1 Quick Check
6. Disk Information
6.1 Source Disk
6.2 Dest Disk
7. Disk Utilities
7.1 Remove DCO & HPA
7.1.1 Source Disk
7.1.2 Dest Disk
7.2 Remove HPA
7.2.1 Source Disk
7.2.2 Dest Disk
8. Logs
8.1 View Logs
8.2 Save All Logs
8.3 Print All Logs
8.3.1 Newest to Oldest
8.3.2 Oldest to Newest
8.4 Erase Logs
9. Setup
9.1 Examiner Name
9.2 Date and Time
9.3 Duplicate Optns
9.3.1 Startup
9.3.2 MD5 Hash
9.3.3 SHA1 Hash
9.3.4 Chunk Size
9.3.5 Read Fail
9.3.6 Err Limit
9.3.7 File Name
9.3.8 Restore Options
9.4 TD1 Info
9.5 Power Info
9.6 Factory Reset
The following sections describe each of the menu choices in detail.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 25
5.2.1 Duplicate Disk
From the Duplicate Disk menu you can select Disk-to-Disk (cloning) or Disk-to-File (imaging).
5.2.1.1 Disk-to-Disk / Cloning (Menu 1.1)
Disk-to-Disk duplication, sometimes called cloning, is the process of making a sector-by-sector copy from
the source disk to the destination disk.
1
S
D
[
.
r
s
B
1
D i s k - t o - D i s k
c : S T 3 8 0 2 1 5 A
t : W D C
W D 4 0 0 0 A A K S - 0
a c k ]
[ S t a r t ]
From the Disk-to-Disk menu select the [Start] soft key to begin duplication. The TD1 will display an onscreen indication of duplication progress. During the duplication you may press [Cancel] to terminate the
duplication or you may press [Details] to see more information regarding the duplication in progress.
1
[
A
[
.
■
v
C
1
.
e
a
.
.
r
n
1
D u p l i c a t i n g
. . . . . . . ]
1 4 %
a g e :
4 . 6
G B / m
c e l ]
[ D e t a i l s ]
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 26
5.2.1.1.1 Disk-to-Disk Details
The following details are available during Disk-to-Disk duplication or at the end of duplication.
Legend
Example Value
Meaning/Description
Task
Disk to Disk
Indicates Disk-to-Disk duplication has been
selected.
Stat
Ok
Error
Incomplete
Current status of the duplication.
Date
2008-10-14
Date on which the duplication started.
Time
14:54
Time at which the duplication started.
User
Tableau
The name of the user (see Section 5.2.9.1).
Model
ST380215A
The model of the source disk.
S/N
9RX7Y3DP
Serial number of the source disk.
Model
WDC WD4000A
The model of the destination disk.
S/N
WD-WCAS838529
Serial number of the destination disk.
Counted
0
Number of read errors on source disk.
Recorded
0
Number of read errors recorded in the logs.
This may be less than the number of errors
counted if the log entry is full. Log entries can
typically record up to several hundred errors for
each logged operation.
SHA1
<<no info>>
MD5
<<no info>>
<<no info>> will be displayed until the operation
is finished. Once the operation is finished the
hash value will be displayed.
--Source Disk--
--Dest Disk--
--Errors--
--Hashes--
Table 5. Disk-to-Disk Details
5.2.1.2 Disk-to-File / Imaging (Menu 1.2)
Disk-to-File duplication, sometimes called imaging, is the process of copying the entire source disk (all
sectors) into one or more files on the destination disk. The destination disk must be formatted with a
supported file system such as FAT32.
From the Disk-to-File menu select the [Start] soft key to begin duplication. The TD1 will display an onscreen indication of duplication progress. During the duplication you may press [Cancel] to terminate the
duplication or you may press [Details] to see more information regarding the duplication in progress.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 27
5.2.1.2.1 Disk-to-File Details
The following details are available during Disk-to-File duplication or at the end of duplication.
Legend
Example Value
Meaning/Description
Task
Disk to File
Indicates Disk-to-File duplication has been
selected.
Stat
Ok
Error
Incomplete
Current status of the duplication.
Date
2008-10-14
Date on which the duplication started.
Time
14:54
Time at which the duplication started.
User
Tableau
The name of the user (see Section 5.2.9.1).
Model
ST380215A
The model of the source disk.
S/N
9RX7Y3DP
Serial number of the source disk.
Model
WDC WD4000A
The model of the first destination disk (see note
following this table).
S/N
WD-WCAS838529
Serial number of the first destination disk.
Chunk Size
4.0 GB
Indicates the chunk size being used for files on
the destination disk(s).
# of Chunks
10
Number of chunks written (so far) to the
destination disk(s).
Disk Count
1
Number of destination disk(s) used so far.
Counted
0
Number of read errors on source disk.
Recorded
0
Number of read errors recorded in the logs.
This may be less than the number of errors
counted if the log entry is full. Log entries can
typically record up to several hundred errors for
each logged operation.
SHA1
<<no info>>
MD5
<<no info>>
<<no info>> will be displayed until the operation
is finished. Once the operation is finished the
hash value will be displayed.
--Source Disk--
--Dest Disk--
--Errors--
--Hashes--
Table 6. Disk-to-File Details
Disk-to-File operations may span more than one destination disk. The on-screen TD1 display will show
information only for the first destination disk. The log recorded in flash by the TD1 will record information
for each destination disk, and a copy of this log is written to the last destination disk.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 28
5.2.2 Format
From the formatting menu you can manually format either the destination disk (SATA or IDE) or you can
format a USB mass storage device attached to one of the TD1's USB ports.
5.2.2.1 Format Dest (Menu 2.1)
The Format Dest option allows you to format the destination SATA or IDE disk with the FAT32 file system
used by the TD1.
The TD1 does what is generally referred to as a "Quick Format." In other words, the TD1 writes the
necessary Master Boot Record, Partition Boot Record, and FAT32 data structures to the destination disk.
The TD1 does not do a full surface scan of the destination disk. If you want to verify the integrity of the
destination disk you should format it using a traditional computer and operating system.
Hint: You don't really need to pre-format destination drives when using the Disk-to-File duplication
mode of the TD1. If a destination disk is blank, the TD1 will automatically format it with the FAT32
file system.
5.2.2.2 Format USB (Menu 2.2)
The Format USB option allows you to format a USB mass storage device connected to one of the TD1's
USB ports. You must attach a USB mass storage device (like a thumb drive) to one of the TD1's USB
ports before selecting this option.
Note: You may only attach one USB mass storage device to the TD1 at a time. Connecting more
than one USB mass storage device to the TD1's USB ports may lead to confusing results, as you
won't know which USB mass storage device the TD1 is actually using.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 29
5.2.3 Wipe Disk
The Wipe Disk menu gives you two options for wiping the destination disk (SATA or IDE). You can
perform a fast, one-pass wipe or you can perform a multi-pass wipe.
5.2.3.1 One Pass Write (Menu 3.1)
The TD1 will write a constant pattern of zeros (00h) to the destination drive in a single pass. The TD1 will
display on-screen performance and timing metrics during the wiping process.
You may cancel the wiping operation at any time by pressing the [Cancel] soft key.
Note: The TD1 will not automatically overwrite an HPA or DCO on the destination drive.
5.2.3.2 Multi Pass Write (Menu 3.2)
The TD1 performs full passes of writes to the destination drive. The first pass writes zeros (00h), the
second pass writes ones (FFh), and the third pass writes a randomly selected constant value between
01h and FEh. The TD1 will display on-screen performance and timing metrics during the wiping process.
You may cancel the wiping operation at any time by pressing the [Cancel] soft key.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 30
5.2.4 Hash Utilities
There are times when a forensic practitioner would like to be able to calculate the hash signatures (or
fingerprints) for a source disk without making a copy of the disk. The Hash Utilities menu gives the user
the ability to hash the hard disk attached to the "source" side of the TD1.
You may cancel the hashing operation at any time by pressing the [Cancel] soft key.
Note: If the source disk has an HPA-protected region, the TD1 automatically disables the HPA before
performing the hash calculation. This is the same as the TD1's behavior during duplication. So, if
you compare the hash values produced when duplicating a disk and when using the Hash Utilities,
you should get the same hash results.
When the hashing operation is finished, the TD1 prompts you to press the [Ok] soft key. After pressing
[Ok] you will see a Hash Options menu:
Hash Options
1.
View Hash
2.
Compare to Logs
Selecting View Hash lets you view the MD5 and SHA-1 hash results on the TD1 display. The MD5 and
SHA-1 hash results are too wide to display completely on screen, so you may use the left and right arrow
keys to scroll the hash results.
Selecting Compare to Logs lets you see quickly if you have recently performed any other tasks with the
same source drive on this TD1 unit. The TD1 will search the logs stored in flash memory looking for any
Disk-to-Disk, Disk-to-File, or Hash log entries which have matching hash values. If there are any
matching entries, the TD1 will show you a list of the matching entries.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 31
5.2.5 Blank Check
The Blank Check menu gives the user the ability to do a quick blank check on either the source or the
destination drive.
After selecting the source disk or the destination disk you should select "Quick Check". This will perform
a quick check to determine of the selected disk appears to be blank. When performing a "Quick Check"
the TD1 reads sectors in the Master Boot Record, the Primary GPT, and the Secondary GPT. A sector is
considered to be blank if it contains only a repeating pattern such as 00h, E5h, or FFh. Any nonrepeating pattern is considered to be non-blank. If all sectors read by the TD1 have repeating patterns
(though not necessarily the same repeating pattern), then the TD1 concludes the drive may be blank.
Important: A "Quick Check" is not an exhaustive check of the entire drive. It is possible for a drive
to appear to be blank according to the quick check while still storing forensically relevant
information. A forensic examiner should treat "blank" source disks with some suspicion and use
other tools, like a Tableau write blocker, to examine the drive to see if it contains forensically
relevant information.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 32
5.2.6 Disk Information
The TD1 is capable of displaying detailed information for either the source or destination hard disks.
Source Disk (Menu 6.1) displays information for the SATA or IDE hard disk attached to the source side of
the TD1. Dest Disk (Menu 6.2) displays information for the SATA or IDE hard disk attached to the
destination side of the TD1.
The following information is displayed:
Legend
Example Value
Meaning/Description
Model
ST380215A
The model named reported by the hard disk
through the ATA IDENTIFY command.
S/N
9RX7Y3DP
The serial number reported by the hard disk
through the ATA IDENTIFY command.
Firm Rev
3.AAD
The firmware revision reported by the hard disk
through the ATA IDENTIFY command.
Capacity
40.0 GB
The capacity of the hard disk as it will be
copied/used by the TD1.
LBA
20,000,000
The capacity in sectors as reported by the hard
disk at power ON.
HPA
78,125,000
The capacity in sectors as reported by the hard
disk using the ATA HPA (Host Protected Area)
feature set.
DCO
156,301,488
The capacity in sectors as reported by the hard
disk using the ATA DCO (Device Configuration
Overlay) feature set.
HPA in use
Yes
"Yes" if the ATA HPA feature set is being used
to reduce the apparent capacity of the hard disk.
DCO in use
Yes
"Yes" if the ATA DCO feature set is being used
to reduce the apparent capacity of the hard disk.
Sec in use
No
"Yes" if the ATA Security feature set may be in
use to password protect the contents of the hard
disk.
Cable
IDE
"IDE" or "SATA".
PIO mode
PIO 4
The PIO (Programmed I/O) mode being used by
the TD1 to communicate with the hard disk.
DMA mode
UDMA 5
The DMA or UDMA mode being used by the
TD1 to communicate with the hard disk.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 33
--Inst Power-5v
4.79 V 398 mA
Real-time display of the +5VDC supply to the
hard disk and the current being consumed by
the hard disk on +5VDC.
12v
12.4 V 249 mA
Real-time display of the +12VDC supply to the
hard disk and the current being consumed by
the hard disk on +12VDC.
5v
4.70 V 1.8 A
Records the maximum current consumed by the
hard disk on the +5VDC supply and the voltage
on the supply at the time of the maximum
current reading.
12v
12.3 V 794 mA
Records the maximum current consumed by the
hard disk on the +12VDC supply and the
voltage on the supply at the time of the
maximum current reading.
--Peak Power--
Table 7. Disk Information Displayed by TD1
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 34
5.2.7 Disk Utilities
The TD1 automatically detects the use of the ATA HPA (Host Protected Area) and DCO (Device
Configuration Overlay) feature sets. Both HPA and DCO feature sets can be used to reduce the apparent
capacity of a hard disk. From a forensic point of view it is valuable to know if HPA and/or DCO are in use.
With that knowledge, the forensic practitioner can make an informed decision about whether or not to
acquire data in the "hidden" regions of the drive.
It is possible to disable HPA without making a permanent modification to the drive, so the TD1
automatically disables HPA on any hard disk connected to the source side of the duplicator. It is not,
however, possible to disable DCO without making a permanent modification to the hard disk, and for this
reason the TD1 will not automatically disable DCO on the source hard disk.
The TD1 never makes automatic changes to HPA and DCO on a destination hard disk. The TD1 is
designed using the assumption that the forensic practitioner has complete control over the destination
hard disk; if you choose to restrict the destination drive capacity using HPA or DCO, the TD1 will not
override that decision.
The options within the Disk Utilities menu allow the user to permanently disable either just the HPA or
both the DCO and HPA on either the source or destination hard disk under user control.
5.2.7.1 Remove DCO & HPA (Menu 7.1)
It is not possible to remove a DCO-protected region on a hard disk without also removing any HPAprotected region. If you want to remove permanently both the HPA and DCO on either the source or
destination hard disk, use the options under this menu.
5.2.7.2 Remove HPA (Menu 7.2)
It is possible to remove an HPA-protected region on a hard disk without making any changes to the DCO
settings on the hard disk. If you want to remove permanently the HPA on either the source or destination
hard disk, use the options under this menu.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 35
5.2.8 Logs
Whenever the TD1 performs an operation which reads, writes or modifies a hard disk it creates a log
entry to record that operation.
The TD1 has an internal flash memory with the capacity to store approximately 59 of the most recently
logged operations.
Once the TD1 has stored 59 log entries the creation of a new log entry will automatically overwrite
the oldest log entry.
The Logs menu gives the user the ability to view, print, save, and erase log entries.
5.2.8.1 View Logs (Menu 8.1)
Selecting the View Logs option displays a list of the logs currently recorded in the TD1's internal flash
memory. The most recent log entry is displayed at the top of this list with the oldest log entry at the
bottom (end) of the list. Log entries are displayed as:
10-13 12:46 Wip Ok
10-13 12:45 Wip X
…
The first part of the line is the month and date (MM-DD) on which the log was recorded. The second part
of the line is the time at which the log was recorded (HH:MM) using a 24-hour clock format.
The third part of each line is a three-character abbreviation indicating the type of task recorded in the log.
In the above example, "Wip" refers to a Disk Wiping operation. The 3-character codes are listed earlier in
this manual in Table 3.
The last part of the line is an abbreviation which indicates the result of the logged operation:
Abbreviated Result
Explanation/Meaning
Ok
Task completed normally.
Er
Task completed with an error.
X
Task was aborted/cancelled by the user.
NC
Task did not finish. This might happen, for example,
if the duplicator is turned off in the middle of the
task.
Table 8. Abbreviated Result Codes Used in TD1 Log Listings
Use the up/down arrows to scroll through the list of log entries. As you are scrolling through the list of log
entries a small sideways triangle ► indicates the currently selected log entry. To view the currently
selected entry press the [Select] soft key.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 36
5.2.8.2 Save All Logs (Menu 8.2)
It is possible to save all logs to a USB storage device connected to one of the TD1's USB ports. After
connecting a USB storage device (i.e., a USB thumb drive) to one of the TD1's USB ports, select the
Save All Logs option to save the logs. Logs are saved in an ASCII text format and you should be able to
view the logs using a text editor of your choice.
Section 4.4.2 illustrates the naming convention used by the TD1 when saving logs to a USB storage
device.
5.2.8.3 Print All Logs (Menu 8.3)
It is possible to print all logs to a USB printer attached to one of the TD1's USB ports. After connecting a
USB printer to one of the TD1's USB ports, select the Print All Logs option to print the logs. After
selecting Print All Logs you will be asked to select whether logs should be printed in the order of "Newest
to Oldest" or in the order of "Oldest to Newest".
Note: The TD1 is compatible with USB printers which support the USB Printer Class Specification.
Further, the USB printer must support raw ASCII printing.
5.2.8.4 Erase Logs (Menu 8.4)
Some users may wish to erase the logs stored in the TD1's internal flash memory. Selecting the Erase
Logs option will perform a physical erase of the flash memory in which the logs are stored. It is not
possible to recover the logs after Erase Logs is finished.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 37
5.2.9 Setup
The Setup menu provides options for setting TD1 options, defaults, and the current date/time. The Setup
menu also provides options for viewing TD1 information and current status.
5.2.9.1 Examiner Name (Menu 9.1)
The Examiner Name option lets you set or change the name of the examiner or user of the TD1. This
information will appear in each log recorded by the TD1.
9
T
[
[
.
a
A
C
1
E x a m i n e r
N a m e
b l e a u _ _ _ _ _ _ _ _ _ _ _ _ _
]
a
s p c
d e l
a n c e l ]
[ S a v e ]
Alphabetic names may be entered using upper and lower case letters and spaces. The square brackets
('[' and ']') indicate the selected data entry mode: enter an upper case character (as in the above
example), enter a lower case character, enter a space ("spc"), or delete a character ("del"). The up/down
arrows select the desired alphabetic character. The center button on the arrow keypad enters a letter or
selects the delete function.
Once you have set the desired name, press the [Save] soft key to record your changes.
5.2.9.2 Date and Time (Menu 9.2)
The Date and Time option lets you set or change the time stored by the real time clock in the TD1. The
TD1 display will look similar to:
9 . 2
[ 2 0 0 8
1
[ C a n c e l
D a t e
a n d
T i m e
] /
1 0
/
1 4
4
:
1 0
]
[ S a v e ]
The square brackets ('[' and ']') indicate the currently selected field ("2008" in the above example). Use
the left and right arrow keys to select the desired field. Use the up and down arrow keys to change the
value in each field. Once you have set the desired date and time, press the [Save] soft key to record your
changes.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 38
5.2.9.3 Duplicate Optns (Menu 9.3)
Duplicate Optns lets the user specify the duplicator startup mode and other options related to disk
duplication. The following table lists the options and values which may be set for each option.
Option
Choices
Default
Meaning/Description
StartUp
Disk
File
Main Menu
Disk
Specifies the TD1 startup mode as:
Disk = Disk-to-Disk duplication
File = Disk-to-File duplication
Main Menu = Main Menu
MD5 Hash
On
On
SHA1 Hash
On
On
The TD1 can hash at drive speed up to
the maximum 100 MB/sec data rate
supported by the TD1 itself. So,
hashing is always enabled.
Chunk Size
4 GB
2 GB
1 GB
700 MB
4 GB
Chunk size affects the size of file
chunks written when performing Disk-toFile (imaging) operations.
Read Fail
Fast
Complete
Complete
The TD1 supports two different error
recovery modes, fast and complete.
These modes are explained in the text
following this table.
Err Limit
No Limit
1000
100
One
Zero
100
Specifies the maximum number of
errors allowed on the source drive.
File Name
Default
DMG
Default
Specifies the file naming convention
used during Disk-to-File duplication. In
default mode the first "chunk" is named
"IMAGE.001". In DMG mode the first
chunk is named "IMAGE.DMG".
Table 9. Duplicator Options
There is also a "Restore Options" selection under Duplicate Optns. Selecting this option automatically
restores all Options to the settings shown in the "Default" column in the preceding table.
5.2.9.3.1 Error Recovery Modes
The TD1 supports two different error recovery modes, "fast" and "complete". Both modes refer to the way
in which the TD1 recovers from read errors on the source hard disk.
The "complete" error recovery mode is the default and more exhaustive of the two modes. When the TD1
detects a read fault in complete mode it begins a retry strategy which will read all sectors which are
readable from the drive. Complete mode will therefore produce the most complete destination image.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 39
However, the exhaustive strategy used by the TD1 may also be very time-consuming if the source drive
has many read faults.
The "fast" error recovery mode is intended for use with drives which have a high number of read faults.
When in "fast" mode, the TD1 treats the source drive as a series of 128-sector blocks (65,536 byte
blocks). An error in any 128-sector block will cause the entire block to be treated as an error. This allows
the TD1 to move much more quickly through a drive with many read faults, but at the loss of some
potentially readable sectors near each fault.
In both error recovery modes the TD1 handles unreadable sectors the same way. When the TD1 has
determined that a sector cannot be read from the source drive, it "fills in" the missing data with zeros on
the destination drive. Zero data inserted in this way is also included by the TD1 when calculating the
MD5 and SHA1 hashes for the duplication.
The TD1 treats all media errors on a destination disk as fatal / unrecoverable errors. Tableau's
philosophy is that each destination disk is receiving a copy of evidence which is critical to a forensic
examination. As such, it is unwise to allow the user to store data to a destination disk with known
defects.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 40
5.2.9.4 TD1 Info (Menu 9.4)
Selecting the TD1 Info option displays selected information for the TD1 itself as shown in the following
table:
Legend
Example Value
Meaning/Description
S/N
01d1000c
The TD1 serial number.
FWVersion
1.20
The TD1 firmware release.
FWDate
Oct 10 2008
The build date for the TD1 firmware release.
FWTime
09:05:46
The build time for the TD1 firmware release.
Table 10. Information Displayed by Setup → TD1 Info
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 41
5.2.9.5 Power Info (Menu 9.5)
The Power Info option lets you view the current voltage and current for each of the source and destination
power ports on the TD1. This information is similar to information which is displayed at the end of the
Disk Information display (see Section 5.2.6) for each drive.
--Inst Power-5v
4.79 V 398 mA
Real-time display of the +5VDC supply to the
hard disk and the current being consumed by
the hard disk on +5VDC.
12v
12.4 V 249 mA
Real-time display of the +12VDC supply to the
hard disk and the current being consumed by
the hard disk on +12VDC.
5v
4.70 V 1.8 A
Records the maximum current consumed by the
hard disk on the +5VDC supply and the voltage
on the supply at the time of the maximum
current reading.
12v
12.3 V 794 mA
Records the maximum current consumed by the
hard disk on the +12VDC supply and the
voltage on the supply at the time of the
maximum current reading.
--Peak Power--
Table 11. Information Displayed by Setup → Power Info
There is an important difference between the power information displayed through the Power Info option
in Setup and the power information displayed at the end of Disk Information. Disk Information is
displayed only after the TD1 has successfully recognized the attached hard disk. Using the Power Info
option in Setup you can view power information whether or not the TD1 has successfully detected the
attached hard disk. This information can be useful in diagnosing disk detection problems.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 42
5.2.9.6 Factory Reset (Menu 9.6)
The Factory Reset option resets all TD1 configuration settings and defaults to the factory state. Factory
Reset also does a physical erase of all logs stored in TD1 flash.
After performing a Factory Reset the TD1 retains no user-specific or case-specific information.
The only setting not cleared by a Factory Reset is the current date and time.
Section 4.5 provides additional information regarding data stored in non-volatile memory by the TD1.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 43
6. Troubleshooting and Support
6.1 Troubleshooting Common Problems
6.1.1 Power Supply Issues
The TP3 power supply provided with the TP1 has the following voltage/current ratings
Voltage
Current
+5VDC +/- 5%
4A
+12VDC +/- 5%
4A
These ratings are adequate to power the TD1 and nearly all combinations of one or two hard disks. The
TD1 also employs staggered power sequencing for the source and destination hard disks. Staggered
sequencing means the TD1 will first apply power to one drive, wait a few seconds while the first drive
spins up, then apply power to the second drive. So, when using the TD1 it is normal to hear the source
and destination drives spin up separately.
During power ON initialization and self-test, the TD1 will check the output voltages of the TP3 power
supply. If either the +5VDC or +12VDC is below the minimum specification, the TD1 will display an onscreen warning.
Hint: There is a green LED on the rear edge of the TD1 next to the DIN power connector. If the TP3
power supply is connected properly to the TD1 and to AC power, the green LED should be ON. The
TD1 itself does not need to be turned ON. If you are having difficulty turning ON the TD1, check the
status of this LED to ensure that the TD1 is receiving power from the TP3 power supply.
6.1.2 Problems with Disk Detection
When using a product like the TD1, the most common problem users encounter is a failure to achieve
drive detection. Most drive detection problems are the result of improper cabling. The following table lists
the most common drive detection problems and corrective actions.
Problem
Corrective Action
Hard disk does not spin up.
NOTE: The TC2-8 ("Molex" or legacy style) and TC5-8 (SATA style) power
cables provided by Tableau have easy-release blue connectors. While these
blue connectors make it much easier to unplug the 4-pin "Molex"-style power
plug, these blue connectors are sometimes tricky to use, especially for users not
familiar with them.
Check the power connection between the TD1 and the hard disk. Be especially
careful to ensure that the blue 4-pin power connectors are properly seated in the
connectors on the TD1 and on the hard disk (if using cable model TC2-8). The
blue connectors should be fully inserted in the TD1 and hard disk. The blue 4pin connectors should not be loose and it should not be possible to remove
these connectors without squeezing the blue tabs on the cable connector.
TD1 does not detect IDE hard
disk.
IDE hard disks should be set for "Master" or "Single Drive".
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 44
TD1 does not detect 3.5" IDE
hard disk.
Normal 3.5" IDE hard disks may be connected to the TD1 using either the 8"
TC6-8 IDE cable or the 2" TC6-2 cable. In either case, the blue end of the IDE
cable must be connected to the TD1.
You must never use an IDE cable longer than 8" with the TD1. Always use the
Tableau-provided, high-quality, 80-conductor TC6-8 or TC6-2 cable.
TD1 does not detect notebook
IDE hard disk.
When using one of the notebook drive adapters provided with the TD1 (model
TDA5-18, TDA5-25, or TDA5-ZIF), you must always use the 2" TC6-2 IDE cable.
Never use the 8" TC6-8 IDE cable or any non-Tableau IDE cable when using a
notebook drive adapter.
When using notebook drive adapters, the blue end of the TC6-2 IDE cable
should be connected to the TD1 and the black end of the cable should be
connected to the notebook drive adapter.
TD1 does not detect ZIF-style
notebook IDE hard disk.
There are several models of "ZIF" hard disks. Please refer to the Support pages
on Tableau's web site for documentation regarding the proper selection and
orientation of ZIF cables when using the TDA5-ZIF kit provided with the TD1.
TD1 does not detect SATA hard
disk.
Use only the 8" TC3-8 SATA cable provided by Tableau. With some SATA hard
disks the SATA connector may be loose. Ensure that the TC3-8 cable is seated
properly in the hard disk's SATA connector.
Too many hard disks connected
to TD1.
The TD1 is a 1-to-1 duplicator, meaning you can connect one source disk and
one destination disk to the duplicator at a time.
For example, if you are using a SATA destination hard disk, the IDE connector
on the "destination side" of the TD1 should be left unconnected and vice versa.
Table 12. Troubleshooting Disk Detection Issues
Tableau has tested the TD1 with an extensive in-house library of different hard disks spanning many
years of hard disk development. Even so, there may be occasional hard disks with which the TD1 is not
compatible. Generally speaking, Tableau can correct such compatibility problems by issuing firmware
updates. If you have a hard disk which cannot be recognized by the TD1, please check the Support
pages on Tableau's web site to see if any firmware updates are available for the TD1.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 45
6.1.3 Real-Time Clock / Battery
The TD1 has a built-in real-time clock (RTC) with a battery backup. The battery will allow the TD1 to keep
time accurately for 1 to 1 ½ years when power is not applied to the unit. If you use your TD1 frequently
and the TD1 power switch is ON, then battery life may be extended.
The battery is a user-serviceable item, and the TD1 will display a warning message after power-ON if the
battery is low.
For detailed battery replacement instructions please refer to Appendix A.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 46
6.2 Support
If you have problems using the TD1 Forensic Duplicator, we strongly encourage you to visit the support
pages on Tableau's web site.
http://www.tableau.com/support
Here you will find answers to common questions, information regarding specific compatibility issues and
firmware updates for your TD1 Forensic Duplicator.
E-mail support for the TD1 Forensic Duplicator is available through:
[email protected]
We are sorry, but Tableau does not provide technical support by phone.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 47
Appendix A. Battery Replacement
The TD1 has a built-in real-time clock (RTC) with a battery backup. The battery will allow the TD1 to keep
time accurately for 1 to 1 ½ years when power is not applied to the unit. If you use your TD1 frequently
and the TD1 power switch is ON, then battery life may be extended.
The battery is a user-serviceable item, and the TD1 will display a warning message after power-ON if the
battery is low.
The following sections illustrate the replacement of the TD1 battery.
A.1
Compatible Batteries
The TD1 uses an ANSI/NEDA type 5012LC battery. The following table lists several common batteries
compatible with this type.
Manufacturer
Model #
Duracell
DL1220
Energizer
CR1220
Rayovac
CR1220
Table 13. Compatible Batteries
A.2
Tools Required
You will need a #1 Philips screwdriver to open the TD1 case. You will also need a small flat-blade
screwdriver to remove the battery from the battery holder.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 48
A.3
Opening the TD1
It is necessary to open the TD1 case in order to replace the battery.
Disconnect all the power supply and all cables from the TD1 before opening theTD1 case.
Never connect the power supply or operate the TD1 when the case is open.
After disconnecting the power supply and all cables, turn the TD1 upside down on a clean work surface.
Figure A 1. Rear View of TD1 Showing Screws
Locate the four case screws as shown in the picture. Using the #1 Philips screwdriver, carefully remove
the four screws and set them aside.
Next, carefully lift the rear half of the plastic case away from the TD1. You will notice that the rear half of
the plastic enclosure partially surrounds the 1394 connector (shown at the bottom right in the preceding
picture). This will prevent you from lifting the rear half of the case in a straight direction. Instead, lift the
top edge (near the power switch) first, then tilt the case towards you and pull it towards your body.
While removing the case be sure to leave the TD1 lying on the clean work surface. Lifting or
tilting the TD1 may cause the main circuit board to move, possibly causing a "Flex Cable"
connector to come loose.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 49
After you have successfully removed the rear half of the plastic case, gently set it aside. You should now
see the inside of the TD1 as shown in the following picture.
Figure A 2. View of TD1 with Rear Case Removed
There are actually two circuit boards in the TD1. The second board is hidden from view in the above
picture. As shown in the picture there is a "Flex Cable" at the bottom edge of the main circuit board which
connects the two circuit boards. If you lift the main TD1 circuit board away from the front half of the
enclosure you may cause this cable to become loose, causing the TD1 to malfunction.
It is difficult to re-attach the Flex Cable correctly. So, as you replace the battery, please be careful not to
move the main circuit board.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 50
A.4
Locating and Replacing the Battery
In the upper left of the main TD1 circuit board you will see the battery as noted in the preceding picture.
The following is a detailed image of the battery and surrounding components.
Figure A 3. Close-up View of Battery
Use a flat blade screwdriver to pry the battery gently from the battery holder. Then, replace the battery
using one of the compatible batteries listed earlier in this Appendix. When re-installing the battery, make
sure the positive terminal of the battery is visible (facing upward).
A.5
Re-Closing the TD1
It can be a little tricky to re-install the rear half of the plastic case because of the shape of the 1394
connector. The correct and easiest way to re-install the case is to tilt the bottom edge of the rear case
into position first, then to tip the case downward while simultaneously aligning the USB and 1394
connectors at the bottom of the case.
When you opened the TD1 you may have noticed that the same four screws which hold the case together
also hold the main TD1 circuit board in position. If you have re-closed the case correctly, the case will
self-align with the circuit board, and you should be able to re-install the four case screws without
interference.
After re-installing the four case screws (again, using a #1 Philips screwdriver), pick up the TD1 and
inspect it to make sure it is closed properly.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 51
A.6
Testing the New Battery
After you have re-closed the TD1, turn it right-side-up and attach just the TP3 power supply. Turn on the
TD1 and observe the power-ON messages. You should not see a battery warning dialog but you may
see a warning indicating that the date/time has been lost and needs to be re-set.
From the TD1 Main Menu select Setup Menu → Date and Time to reset the date and time. See Section
5.2.9.2 Date and Time (Menu 9.2) for detailed instructions on setting the date and time.
After setting the date and time, turn OFF the TD1. Wait 1-2 minutes, then turn the TD1 ON again. The
date and time should be set correctly. You can see the date and time in the upper-left corner of the Main
Menu, or you can see the date and time by navigating to Setup Menu → Date and Time.
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
p. 52
Index
AC line cord
6
Alert LED
5
arrows keys
8
battery
46, 48
blank check
20, 25, 32
buttons
23
capacity
5
cloning
8, 12, 26
conditions
17, 18
Configuration Wizard
8, 15, 21
contrast
24
controls
23
conventions
5
date and time
25, 38, 52
DCO
4, 17, 20, 21, 25, 30, 33, 35
details
12, 26, 27, 28
disk detection
44, 45
disk information
33
disk utilities
35
DMG
19, 39
drive detection
15
duplication
12, 17
erase logs
22, 25, 37
error recovery
39
examiner name
25, 38
factory reset
8, 15, 22, 25, 43
file structure
19
firmware
7, 19, 20, 21, 22, 33, 41, 45, 47
FLASH
8, 21, 22, 28, 31, 36, 37, 43
forensic duplicator
4
forensic practice
4
format
29
hash
4, 25, 31, 39
HPA
4, 17, 20, 21, 25, 30, 31, 33, 35
imaging
6, 8, 11, 12, 19, 26, 27, 39
Tableau TD1 Forensic Duplicator Users’ Guide
Copyright © 2008-09 Tableau, LLC, revised January 7, 2009
kit
LEDs
logs
MD5
menus
naming conventions
non-volatile memory
notebook adapter
notebook hard disk
power info
power supply
print
progress
Quick Start
real-time clock
save
self-test
setup
SHA-1
signal cable
soft keys
startup
startup mode
support
TD1 Info
TDA5-18
TDA5-25
TKDA5-ZIF
transfer rates
troubleshooting
USB storage device
web site
white paper
wiping
ZIF
6, 7, 45, 46, 48
10, 15, 23
36
See hash
25
19
21, 43
11
7, 11
42
6, 8, 11, 15, 44
37
16
4, 6, 7, 9
22, 46, 48
37
15, 44
38
See hash
7, 11
5, 8, 9, 23
14, 15, 25
8, 15, 22, 39
4, 44, 45, 47
41
7, 11, 45
7, 11, 45
7
5
4, 44, 45, 46, 48
20
47
16
13, 16, 20, 25, 30, 36
7, 11, 45
p. 53
Was this manual useful for you? yes no
Thank you for your participation!

* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project

Download PDF

advertisement