Hash (Menu 5.2); Blank Check (Menu 5.3) - Tableau TD2u User Manual

CHAPTER 3 Using the TD2u
Format USB Accessory (Menu 5.1.2)
The Format USB Accessory
rear accessory port. It works the same as formatting a destination, except it operates on
the accessory port rather than any destination disks.

Hash (Menu 5.2)

There are times when a forensic practitioner would like to calculate the hash values, or
fingerprints, for a source disk without making a copy of the disk. With the
menu, you can generate an MD5 and SHA-1 hash value for the hard disk attached to the
source side of the TD2u.
You can cancel the hashing operation at any time by pressing the
If the source disk has an HPA-protected region, the TD2u automatically disables the HPA
before performing the hash calculation. This is the same behavior is exhibited by the TD2u
during duplication. If you compare the hash values produced when duplicating a disk and
when using the Hash
When the hashing operation is finished, the TD2u screen displays the hash results.

Blank Check (Menu 5.3)

The Blank Check menu lets you do a quick blank check on the source or either destination
drive.
The TD2u performs a quick check to determine if the selected disk appears to be blank by
reading sectors in the Primary and Secondary GPT. A sector is considered to be blank if it
contains only a repeating pattern such as 00h, E5h, or FFh. Any non-repeating pattern is
considered to be non-blank. If all sectors read by the TD2u have repeating patterns (though
not necessarily the same repeating pattern), then the TD2u concludes the drive may be blank.
This quick check is not an exhaustive check of the entire drive. It is possible for a drive to
appear to be blank according to the quick check while still storing forensically relevant
information. A forensic examiner should treat blank source disks with some suspicion and use
other tools, like a Tableau write blocker, to examine the drive to see if it contains forensically
relevant information.
option allows you to quickly format a USB disk connected to the
Utilities, you should get the same hash results.
Hash Utilities
[Cancel] soft key.
49