Overview - OPENTEXT Tableau Forensic TD4 User Manual

Chapter 2

Overview

Tableau TD4 is a powerful and intuitive forensic duplicator that offers valuable,
high-performance imaging capabilities in a small, portable package. The touch
screen user interface is easy to use and provides a familiar user experience similar to
modern tablets and smartphones. TD4 is custom built for forensics and provides
many standard and advanced features that serve the specialized needs of digital
forensics practitioners, including:
Acquisition of PCIe, USB, SATA, SAS, FireWire, and IDE drives.
Note: PCIe, IDE, and FireWire adapters (sold separately) are required to image
these drive types.
Output to PCIe, USB, and SATA drives.
The ability to target file-based evidence with logical imaging functionality and
industry standard file outputs (lx01 and metadata csv files).
The ability to duplicate a source drive to up to five destination drives.
The ability to prevent damage to disk drives by spinning them down when they are
ejected from TD4 prior to physical removal.
The ability to lock specific functions and settings with an administrator PIN to
enforce standard settings and procedures for your forensic acquisition jobs.
Superior data transfer rates, even while performing calculations of MD5, SHA-1, and
SHA-256 hash values.
The ability to view extensive drive detail, including partition and filesystem
information.
Browsing drive filesystems.
Extensive filesystem support - APFS, ExFAT, NTFS, EXT4, FAT(12/16/32), and HFS+.
Whole disk, open standard, destination drive encryption using XTS-AES.
The ability to detect and inform of the presence of enabled Opal encryption.
Comprehensive destination and accessory drive wiping capabilities, including NIST
800-88 compliant wipes.
HPA, DCO, and AMA support for the detection and handling of hidden/protected
data areas on source drives. This includes standalone HPA/DCO/AMA disablement,
DCO/AMA "shelving," and trim support for the creation of a destination DCO or
AMA.
Detailed forensic logs in HTML format for case documentation.
The ability to filter the forensic log list to only show logs of interest based on specific
case and/or drive information. The filtered logs can also be exported or deleted.
ISTD230100-UGD-EN-1
User Guide
7