Tableau TD2u User Manual

Tableau TD2u
USER GUIDE
Version 1.3
Copyright© 2018 Guidance Software, Inc. All rights reserved.
EnCase®, EnScript®, FastBloc®, Guidance Software® and EnCE® are registered t rademarks o r trademarks owned b y Guidance Software in the United St ates and other jurisdictions and m ay not be used withou t prior written permission. All other marks and brands may be claimed as the property of their respect ive ow ners. Products and c orp orate names appearing in this work may o r may not be registered trademarks or copyrights of their respective companies, and are used on ly for identification or explanation into t he owners' benefit, without intent to infringe. Any use and d uplication of th is wo rk is subject to the terms of th e license agreement between you and Guidance Software, Inc. Except as stated in the license agreement o r as otherwise permitted under Sections 107 or 108of t he 1976United States Copyright Act, no part of this work may b e reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocop ying, recording, scanning, or otherwise. Pro duct manuals and doc umentation are specific t o the software versions for which they are written. For previous or outdated versions of this work, please c ontact Guidance Software, Inc. at https://www.guidancesoftware.com. Information contained in t his work is furnished for informational use o nly, and is sub ject to change at any time without notice.
January 05, 2018
CONTENTS
Preface 7
About this Guide 7 Conventions Used in this Guide 7 Disk Capacity and Transfer Rate Measurement Con-
ventions 7
CHAPTER 1 Overview 9
Tableau TD2u 11 TD2u Kit Contents 11 Navigating the TD2u 14 Reading the LEDs 15 USB Keyboard Support 15
CHAPTER 2 Setting up the TD2u 17
Startup Sequence 19 Initialization 19 Configuring the TD2u 19 User-Selected Startup Mode 19 System Settings (Menu 7.1) 20 Set Examiner Name (Menu 7.1.2) 21 Imaging Setup (Menu 7.2) 22
- iii -
Error Recovery Modes 25
Factory Reset (Menu 7.3) 26 Duplicator Info (Menu 8) 26 Connecting Hard Drives 27 Drive Detection 29
CHAPTER 3 Using the TD2u 31
Overview 33 TD2u Menus and Options 33 Duplicate (Menu 1) 36
Initiating a Duplication Job (Menu 1) 36
Image Destinations 37
Preconditions Checking 38 Wipe Disk (Menu 2) 41
Single Pass Wipe 42
Multi-Pass Wipe 42
Secure Erase 42
Encryption (Menu 3) 43
Encrypt New Destination (Menu 3.1) 43
Unlock Destinations (Menu 3.2) 44
Change Dest Password (Menu 3.3) 45
Disk Information (Menu 4) 45 Disk Utilities (Menu 5) 47
Format (Menu 5.1) 47
Hash (Menu 5.2) 49
Blank Check (Menu 5.3) 49
HPA/DCO Removal (Menu 5.4) 50
Status Information 50 Logs Menu (Menu 6) 52
View Logs (Menu 6.1) 52
Save All Logs (Menu 6.2) 55
Delete All Logs (Menu 6.3) 55
- iv -
Print All Logs (Menu 6.4) 55
Resetting and Clearing Internally Stored Information 56
CHAPTER 4 Troubleshooting and Support 59
Troubleshooting Common Problems 61
Power Supply Issues 61
Problems with Disk Detection 61
Problems with Encrypted Drives 63
Replacing the Backup Battery for the Real-timeClock 64
Compatible Batteries 64
Replacing the Battery 64
Testing the New Battery 67
Index 69
- v -
- vi -
Preface 7

PREFACE

About this Guide

This guide presents a wide range of technical information and procedures for using the TD2u. It is divided into the following chapters.
l Overview: Provides general information about the TD2u as well as unpacking, starting
up, and navigating the TD2u menus and indicators.
l Setting up the TD2u: Provides system overview information about the TD2u as well as
procedures for configuring and connecting the TD2u.
l Using the TD2u: Provides detailed information and procedures for using the TD2u. l Troubleshooting and Support: Provides a brief list of potential problems and solutions.
For more complete and current troubleshooting information as well as answers to fre­quently asked questions (FAQ), visit the Tableau web site at www.guid-
ancesoftware.com/tableau.

Conventions Used in this Guide

The TD2u has two soft keys placed immediately under the LCD display. The bottom line of the display shows text indicating the current function for each of the two soft keys. In this guide, soft key labels are indicated with square brackets. For example, [Select] indicates that Select is displayed above a soft key on the display.

Disk Capacity and Transfer Rate Measurement Conventions

The computer industry generally adheres to two different conventions for the definitions of the terms megabyte (MB) and gigabyte (GB). For computer RAM, 1 MB is defined as 220= 1,048,576 bytes and 1 GB is defined as 230= 1,073,741,824 bytes. For disk storage, 1 MB is defined as 106= 1,000,000 bytes and 1 GB is defined as 109= 1,000,000,000 bytes. These two conventions are known as powers of two and powers of ten respectively. Microsoft deviates from the hard disk capacity measurement convention and uses the powers of two convention for its operating systems.
8 Tableau TD2u User Guide Version 1.3.0
Tableau reports disk capacities and transfer rates according to the industry standard powers of ten convention. In TD2u screens, reports, and documentation, a 4 GB hard disk stores up to 4,000,000,000 bytes; a hard disk with a 150 MB/sec transfer rate transfers 150,000,000 bytes per second.
Note: For a complete list of changes for a given TD2u firmware release, see the release notes for the latest TFU version on the Tableau products web page at www.guidancesoftware.com/tableau.
CHAPTER 1
OVERVIEW
Tableau TD2u 11
TD2u Kit Contents 11
Navigating the TD2u 14
Reading the LEDs 15
USB Keyboard Support 15
10 Tableau TD2u User Guide Version 1.3.0
Item Model # Description
TD2u TD2u Forensic Duplicator
CHAPTER 1 Overview 11

Tableau TD2u

The Tableau TD2u is a forensic duplicator capable of performing 1:1, 1:2, and 1:3 duplications. It has many of the functions traditionally found in general-purpose, IT-oriented hard disk duplicators and provides features and functions that serve the specialized needs of forensic practice, including:
l Sustained data transfer rates of up to 16 GB/minute, while performing calculations of
MD5 and SHA-1 hash values, also known as fingerprints.
l Native support for USB 3.0, SATA and IDE hard disks from the source interface. l Parallel duplication to two SATA and one USB 3.0 destination hard disks. l Parallel image and clone duplication. l Optional destination disk encryption to ensure security of imaged source data. l Detailed log generation for case documentation. l Automatic blank checking of source and destination drives. l HPA and DCO support for the detection and handling of hidden/protected data areas on
source and destination drives.
l Multi-lingual support for the UI and character input.

TD2u Kit Contents

The TD2u ships in a boxed kit that includes the following:
Item Model # Description
TP5-NC
High-output power supply. The TP5 provides enough power to supply the TD2u and most common com­binations of source and des­tination hard disks. The TP5 uses a universal 2-pin AC line cord and is compatible with 110-240VAC line voltages worldwide.
TP5-LC-US
North America shipments include the TP5-LC-US AC line cord for use with the TP5-NC power supply. When shipped to other geographic markets, the local reseller typically adds an AC line cord appropriate for the local market.
TC2-8-R2
Hard disk power cable to connect IDE and some leg­acy-style SATA hard disks to the TD2u (3M to Molex).
TC3-8
SATA signal cable to connect SATA hard disks to the TD2u.
12 Tableau TD2u User Guide Version 1.3.0
Item Model # Description
TC4-8-R2
SATA/SAS power/signal cable to SAS and 3M power (2 pieces). This unified cable connects power and signal connectors current hard disks.
TC5-8-R2
Hard disk power cable to connect 15-pin SATA power connectors to the TD2u (SATA to 3M).
TC6-8
IDE signal cable to connect IDE hard disks to the TD2u. Do not use the TC6-8 IDE cable to connect notebook drive adapters to the TD2u. Use the shorter TC6-2 IDE cable shown with the TKA5­AD adapter pack below.
TC8
USB 2.0 cable. Used to con­nect the TD2u to a host com­puter for firmware updates.
TQS-TD2u
Quick Start card for the TD2u kit.
CHAPTER 1 Overview 13
Do not discard the foam packaging. It is designed to fit several industry-standard hard-sided carrying cases. If you received the TD2u kit in the cardboard box shipped by Tableau, you can buy a hard-sided case and reuse the foam insert directly in that case.
14 Tableau TD2u User Guide Version 1.3.0

Navigating the TD2u

When using the TD2u, you may be prompted to enter certain information into the display. Use the up/down/left/right arrow keys and the center button to select values.
While you are entering information, the TD2u displays two soft key functions at the bottom of the LCD display. The soft keys perform major actions such as selecting a task, canceling a function, or moving between different display screens. Use the arrow keypad to navigate within a given screen/menu. The function of the soft keys depends on the current context. The soft keys might have functions such as [Back] and [Next], as they do during the Configuration Wizard. The soft keys might also serve to select items like [Cancel] and [Ok].
The center button on the arrow keypad also serves as a [Select] button when navigating among TD2u menus. It cannot be used to start major tasks, such as duplication or disk wiping. Only soft keys labeled [Select] or [Start] initiate major tasks. Vertical Arrow Keys scroll up or down and highlight menu items for selection. Horizontal Arrow Keys scroll left or right and toggle between character lists.
In the upper right corner of the Main menu, the TD2u displays the date and time. As you navigate the TD2u menu structure, the menu item number displays in the upper left hand corner. For example, the Disk Utilities menu is Menu 5, the Format menu is Menu 5.1, the Hash menu is Menu 5.2, and so on. These menu numbers help you navigate the menu hierarchy.
CHAPTER 1 Overview 15
The TD2u ships with a Quick Start card illustrating the layout of the display, buttons, connectors, and switches on the TD2u. Keep the Quick Start card with the TD2u as you familiarize yourself with its operation.

Reading the LEDs

The front of the TD2u has nine light emitting diode (LED) indicators. A tenth LED is located on the rear of the TD2u, near the power connector.
The SATA Source, IDE Source, and USB Source LEDs indicate that the source drive is connected to the left side of the TD2u The SATA, Dest 1, SATA Dest 2, and USB DestLEDs indicate that the destination drives are connected to the right side. A yellow Alert LED on the right flashes to indicate the need for user intervention.

USB Keyboard Support

You can connect a standard USB keyboard to any of the USB ports on the front and back of the TD2u. Using a keyboard for data entry can be faster and more convenient than using the arrow keypad on the TD2u.
When using a USB keyboard the Enter key on the keyboard generally corresponds to the right soft key on the TD2u. The Esc (escape) key on the keyboard generally corresponds to the left soft key.
If your keyboard has arrow keys or a mouse-like input device, the up and down arrows (or mouse actions) generally correspond to the up and down (vertical) arrows on the TD2u.
16 Tableau TD2u User Guide Version 1.3.0
CHAPTER 2
SETTING UP THE TD2U
Startup Sequence 19
Initialization 19
Configuring the TD2u 19
User-Selected Startup Mode 19
System Settings (Menu 7.1) 20
Set Examiner Name (Menu 7.1.2) 21
Imaging Setup (Menu 7.2) 22
Factory Reset (Menu 7.3) 26
Duplicator Info (Menu 8) 26
Connecting Hard Drives 27
Drive Detection 29
18 Tableau TD2u User Guide Version 1.3.0
CHAPTER 2 Setting up the TD2u 19

Startup Sequence

The TD2u is optimized for the needs of forensic practitioners and computer forensic processes.

Initialization

After you turn on the TD2u, the device takes about five seconds to initialize and run a self-test procedure. The screen is blank and unlit until the self-test is complete. An LED check is then conducted so you can verify that all of the LEDs are functioning. When initialization is complete, the TD2u displays warning messages about any detected faults.

Configuring the TD2u

The TD2u comes ready to be connected to the TP5 power supply and turned on.
After running a three-second initialization and self-test procedure, the TD2u starts the Configuration Wizard. The Configuration Wizard prompts you for the default username, current date/time, and preferred startup mode. The TD2u stores these settings in non-volatile flash memory for use at each startup.
The startup mode feature lets you customize the TD2u for a specific workflow. The Startup Mode setting provides the following options.
l Main Menu l Duplication (for cloning or imaging) l Wipe Disk
You can configure the startup mode and other settings at any time from the System Settings menu (Menu 7.1).
Once you have configured your TD2u, the startup sequence bypasses the Configuration Wizard unless you have used Factory Reset (Menu 7.3) in the Setup menu.

User-Selected Startup Mode

The TD2u can be configured to display different screens at initial startup. This setting allows for quick access to commonly used functions. For example, if you use the TD2u mainly for duplications, you can customize the startup mode for disk duplication. Details on this and other settings made by the Configuration Wizard are discussed below in the section on System
Settings (Menu 7.1).
Option Choices Default Description
Startup Screen
Main Menu
Duplication
Wipe Disk
Main Menu
Specifies the TD2u startup mode as:
Main Menu = Main Menu
Duplication = Duplication setup screen
Wipe Disk = Wipe Disk
Set Exam­iner Name
[Alphanumeric] NA
The Examiner Name option lets you set or change the name of the examiner or user of the TD2u. This information appears in each log recor­ded by the TD2u.
Alphabetic names can be entered using upper and lowercase letters and spaces. The square brackets in the screen indicate the selected data entry mode: enter an upper case character, enter a lower case character, enter a space (spc), or delete a character (del). The up and down arrows select the desired alphabetic character. The center button on the arrow keypad enters a letter or selects the delete function.
Once you have set the desired name, press the
[Save] soft key to record your changes. See
below for more details.
20 Tableau TD2u User Guide Version 1.3.0

System Settings (Menu 7.1)

The System Settings menu provides options for setting TD2u options, defaults, and the current date/time. The System Settings menu also provides options for viewing TD2u information and current status.
The following table lists additional options and values you can set in System Options.
Option Choices Default Description
Set Date + Time
[Numeric] NA
The Date and Time option lets you set or change the time stored by the real time clock in the TD2u.
The angle brackets in the screen indicate the cur­rently selected field. Use the up and down arrow keys to select the desired field. Use the left and right arrow keys to change the value in each field. Once you have set the desired date and time, press the [Save] soft key to record your changes.
Finished Alert
Off
On
Off
When On, the TD2u flashes the yellow Alert LED at the end of a normal/successful acquis­ition/task.
When Off, the TD2u flashes the yellow Alert LED only if there is an unusual condition or error.
Language
English
French
German
Spanish
Turkish
English Sets the system wide language for the TD2u UI.
CHAPTER 2 Setting up the TD2u 21

Set Examiner Name (Menu 7.1.2)

22 Tableau TD2u User Guide Version 1.3.0
If you are using an external keyboard, entering the Examiner Name is fairly straightforward. Using the TD2u keypad requires scrolling through individual characters. The characters are divided into four categories that appear at the bottom of the screen:
l Capital letters (A) l Lowercase letters (a) l Numbers (0) l Space (spc)
A set of parentheses appears around the currently selected category. In the above display, capital letters is selected.
For capital letters, lowercase letters, and numbers, use the Up and Down buttons to scroll through characters.
Press the center button on the keypad to select a character.
To delete the last character you entered, select del from the keypad.
To clear all text, use the right arrow to move to the del item and press the up or down arrow. This should change del to clr. Selecting this by pressing the center button clears all text.

Imaging Setup (Menu 7.2)

Imaging Setup lets you specify options related to disk imaging operations.
Loading...
+ 49 hidden pages