OPENTEXT Tableau Forensic TD4 User manual

OpenText™ Tableau™ Forensic TD4
Duplicator
User Guide
This guide presents a wide range of technical information and
procedures for using the OpenText Tableau Forensic TD4
Duplicator.
ISTD230100-UGD-EN-1

OpenText™ Tableau™ Forensic TD4 Duplicator
User Guide
ISTD230100-UGD-EN-1
Rev.: 2023-Mar-06
This documentation has been created for OpenText™ Tableau™ Forensic TD4 Duplicator 23.1.
It is also valid for subsequent software releases unless OpenText has made newer documentation available with the product,
on an OpenText website, or by any other means.
Open Text Corporation
275 Frank Tompa Drive, Waterloo, Ontario, Canada, N2L 0A1
Tel: [phone]
Toll Free Canada/USA: 1-800-499-6544 International: [phone]
Fax: [phone]
Support: https://support.opentext.com
For more information, visit https://www.opentext.com
Copyright © 2023 Open Text. All Rights Reserved.
Trademarks owned by Open Text.
One or more patents may cover this product. For more information, please visit https://www.opentext.com/patents.
Disclaimer
No Warranties and Limitation of Liability
Every effort has been made to ensure the accuracy of the features and techniques presented in this publication. However,
Open Text Corporation and its affiliates accept no responsibility and offer no warranty whether expressed or implied, for the
accuracy of this publication.

Table of Contents
1 Preface ........................................................................................ 5
1.1 Drive capacity and transfer rate measurement conventions .................. 5
2 Overview ..................................................................................... 7
2.1 TD4 kit contents ................................................................................ 9
2.2 Navigating TD4 ............................................................................... 10
2.2.1 Home screen .................................................................................. 10
2.2.2 Drive details .................................................................................... 12
2.2.3 System navigation menu ................................................................. 12
2.2.4 Job status ....................................................................................... 13
2.2.5 Job history ...................................................................................... 14
2.3 Reading the status LEDs ................................................................. 16
2.4 Interpreting audio feedback .............................................................. 17
2.5 On-screen warnings ........................................................................ 17
2.6 USB keyboard and mouse support ................................................... 17
3 Configuring TD4 ...................................................................... 19
3.1 Startup sequence ............................................................................ 19
3.2 Configuring TD4 .............................................................................. 19
3.2.1 Settings .......................................................................................... 19
3.2.2 Administration ................................................................................. 22
3.2.3 Locking the system ......................................................................... 25
3.2.4 Updating TD4 firmware .................................................................... 26
3.3 Connecting drives ........................................................................... 27
3.3.1 USB versions and connector types ................................................... 27
3.3.2 Drive adapters ................................................................................ 28
3.3.3 Drive tiles ....................................................................................... 28
3.3.4 Source drives .................................................................................. 28
3.3.5 Destination drives ........................................................................... 29
3.3.6 Accessory drives ............................................................................. 29
3.3.7 Drive detection ................................................................................ 30
4 Using TD4 ................................................................................. 31
4.1 Home screen .................................................................................. 31
4.2 Drive details .................................................................................... 33
4.3 System navigation menu ................................................................. 33
4.4 Job status ....................................................................................... 34
4.5 Job history ...................................................................................... 35
4.6 Viewing sources and destinations .................................................... 37
4.6.1 Blank check .................................................................................... 40
4.6.2 Reconfigure .................................................................................... 40
ISTD230100-UGD-EN-1 User Guide iii

4.6.2.1 Remove sector limitations ................................................................ 41
4.6.2.2 Volatile HPA removal ...................................................................... 42
4.6.2.3 Non-volatile HPA/DCO/AMA removal ............................................... 44
4.6.2.4 Wiping destination or accessory drives ............................................. 46
4.6.2.5 Encrypting destination and accessory drives ..................................... 49
4.6.2.6 Formatting destination and accessory drives ..................................... 50
4.6.3 Opal encryption ............................................................................... 50
4.7 Browsing ........................................................................................ 52
4.8 Case information ............................................................................. 53
4.9 Duplicating ..................................................................................... 53
4.9.1 Cloning ........................................................................................... 54
4.9.2 Imaging .......................................................................................... 54
4.9.3 Performing a duplication .................................................................. 55
4.9.4 Files created during disk-to-file duplication ........................................ 59
4.10 Logical imaging ............................................................................... 60
4.10.1 Performing a logical image .............................................................. 61
4.10.2 Files created during a logical image job ............................................ 65
4.10.3 Logical image verification ................................................................. 65
4.10.4 Source file metadata ....................................................................... 65
4.11 Hashing .......................................................................................... 66
4.12 Verifying ......................................................................................... 68
4.13 Restoring ........................................................................................ 69
4.14 Forensic logs .................................................................................. 70
4.14.1 Sample logs .................................................................................... 71
5 Adapters ................................................................................... 77
5.1 PCIe SSD adapters ......................................................................... 77
5.2 PCIe IDE adapter (TDA7‒5) ............................................................ 77
5.3 PCIe FireWire adapter (TDA7‒9) ..................................................... 78
5.4 SATA/IDE adapters ......................................................................... 78
6 Specifications and troubleshooting ...................................... 81
6.1 Specifications ................................................................................. 81
6.2 Troubleshooting common problems .................................................. 82
6.2.1 Firmware recovery .......................................................................... 83
6.2.2 Power supply issues ........................................................................ 84
6.2.3 Thermal issues ............................................................................... 84
6.2.4 Problems with drive detection .......................................................... 85
6.2.5 Real-time clock data retention issue ................................................. 86
Table of Contents
iv OpenText™ Tableau™ Forensic TD4 Duplicator ISTD230100-UGD-EN-1

Chapter 1
Preface
This guide presents a wide range of technical information and procedures for using
the OpenText Tableau Forensic TD4 Duplicator, a product of OpenText. It is divided
into the following chapters:
Overview: Provides general information about TD4 as well as unpacking, starting
up, and navigating TD4 menus and reading the LEDs.
Configuring TD4: Provides system overview information about TD4 as well as
procedures for configuring and connecting it.
Using TD4: Provides detailed information and procedures for TD4 operation.
Adapters: Describes the adapters that extend the drive acquisition options and
destination drive capabilities of TD4.
Specifications and troubleshooting: Provides TD4 specifications and a brief list of
potential problems and solutions. For more complete and current troubleshooting
information as well as answers to frequently asked questions (FAQ), visit OpenText
My Support (https://support.opentext.com).
1.1 Drive capacity and transfer rate measurement
conventions
The computer industry generally adheres to two different conventions for
definitions of the terms megabyte (MB) and gigabyte (GB). For computer RAM, 1
MB is defined as 220 = 1,048,576 bytes and 1 GB is defined as 230 = 1,073,741,824
bytes. For drive storage, 1 MB is defined as 106 = 1,000,000 bytes and 1 GB is defined
as 109 = 1,000,000,000 bytes. These two conventions are known as powers of two and
powers of ten respectively. Microsoft deviates from the hard drive capacity
measurement convention and uses the powers of two convention for its operating
systems.
Tableau products report drive capacities and transfer rates according to the industry
standard powers of ten convention. In TD4 screens, reports, and documentation, a 4
GB hard drive stores up to 4,000,000,000 bytes; a hard drive with a 150 MB/sec
transfer rate transfers 150,000,000 bytes per second.
ISTD230100-UGD-EN-1 User Guide 5

Chapter 2
Overview
Tableau TD4 is a powerful and intuitive forensic duplicator that offers valuable,
high-performance imaging capabilities in a small, portable package. The touch
screen user interface is easy to use and provides a familiar user experience similar to
modern tablets and smartphones. TD4 is custom built for forensics and provides
many standard and advanced features that serve the specialized needs of digital
forensics practitioners, including:
Acquisition of PCIe, USB, SATA, SAS, FireWire, and IDE drives.
Note: PCIe, IDE, and FireWire adapters (sold separately) are required to image
these drive types.
Output to PCIe, USB, and SATA drives.
The ability to target file-based evidence with logical imaging functionality and
industry standard file outputs (lx01 and metadata csv files).
The ability to duplicate a source drive to up to five destination drives.
The ability to prevent damage to disk drives by spinning them down when they are
ejected from TD4 prior to physical removal.
The ability to lock specific functions and settings with an administrator PIN to
enforce standard settings and procedures for your forensic acquisition jobs.
Superior data transfer rates, even while performing calculations of MD5, SHA-1, and
SHA-256 hash values.
The ability to view extensive drive detail, including partition and filesystem
information.
Browsing drive filesystems.
Extensive filesystem support - APFS, ExFAT, NTFS, EXT4, FAT(12/16/32), and HFS+.
Whole disk, open standard, destination drive encryption using XTS-AES.
The ability to detect and inform of the presence of enabled Opal encryption.
Comprehensive destination and accessory drive wiping capabilities, including NIST
800-88 compliant wipes.
HPA, DCO, and AMA support for the detection and handling of hidden/protected
data areas on source drives. This includes standalone HPA/DCO/AMA disablement,
DCO/AMA “shelving,” and trim support for the creation of a destination DCO or
AMA.
Detailed forensic logs in HTML format for case documentation.
The ability to filter the forensic log list to only show logs of interest based on specific
case and/or drive information. The filtered logs can also be exported or deleted.
ISTD230100-UGD-EN-1 User Guide 7

Always free firmware update support.
Clearly labeled and color-coded source (write blocked) and destination (read/write)
ports.
The left source (write blocked) side of TD4.
The right destination (read/write) side of TD4.
Chapter 2 Overview
8OpenText™ Tableau™ Forensic TD4 Duplicator ISTD230100-UGD-EN-1

2.1 TD4 kit contents
TD4 ships in a boxed kit with custom foam that includes the following items:
Item Model # Description
TD4 OpenText Tableau Forensic
TD4 Duplicator
TP6 Provides power to TD4. Uses
a universal 3-prong style AC
line cord and is compatible
with 100-240V AC line
voltages worldwide.
TC4-8-R4 Unified SATA/SAS signal
and power to 8in. SATA/SAS
signal and 8in. power cable
(qty 3)
TC-PCIE-8 8in. PCIe adapter cable. Must
be used with a Tableau PCIe
adapter (qty 1)
TCA-USB3-AC USB Type A female to Type C
male adapter cable (qty 2)
TPKG-VCT-5 5-piece Velcro cable tie kit
TPKG-CLOTH Microfiber screen cleaning
cloth
Quick Reference Guide
2.1. TD4 kit contents
ISTD230100-UGD-EN-1 User Guide 9

Do not discard the TD4 foam packaging, as it is designed to fit several industry-
standard hard sided carrying cases (for example, the Pelican 1500). If you received
the TD4 kit in the cardboard box shipped by OpenText, you can reuse the stacking
foam inserts in your own hard-sided case.
2.2 Navigating TD4
Use the TD4 touchscreen display to navigate the available TD4 functions. Use the
onscreen virtual keyboard or a USB keyboard to enter alphanumeric text when
prompted. See “USB keyboard and mouse support” on page 17.
2.2.1 Home screen
The home screen of TD4 displays function tiles for initiating the following forensic
jobs:
Duplicate
Logical Image
Hash
Verify
Restore
It also includes tiles for entering/viewing essential information, as follows:
Case Info
Job History
Chapter 2 Overview
10 OpenText™ Tableau™ Forensic TD4 Duplicator ISTD230100-UGD-EN-1

Each function tile may be opened to show more information, enter data, and, if
applicable, start the associated job. Depending on various conditions, the job will
either start immediately after hitting the Start button or an advanced settings screen
will be displayed to allow configuration of specific settings before starting the job.
More details for each home screen function can be found later in this user guide.
Across the top navigation bar there are buttons to quickly access the System
Navigation Menu and the home screen and to view the current time. Tapping the
TD4 model name in the top navigation bar takes you to the home screen.
Note: In the event of abnormal cooling conditions, a thermal event warning
icon will be shown in the top navigation bar to the right of the System
Navigation Menu icon. Such a warning will never be seen under normal
operating conditions. Please refer to “Thermal issues” on page 84 for more
information.
2.2. Navigating TD4
ISTD230100-UGD-EN-1 User Guide 11

2.2.2 Drive details
On the left and right sides of the home screen you will find drive tiles that align with
the physical drive connection ports. These tiles will be inactive (grayed-out) for any
ports that have no drive attached. When a drive is attached to a given port, that tile
will become active and can be tapped to access detailed information about that drive
and perform drive-specific actions.
Note: The drive tile for the rear USB accessory port will only appear when a
drive is connected to that port. It will appear beneath the system Navigation
Menu icon in the top-left corner of the home screen.
See “Using TD4“ on page 31 for more information on drive details.
2.2.3 System navigation menu
Tapping the System Navigation Menu icon in the upper-left corner of the top
navigation bar displays the TD4 System Navigation Menu, as shown below. For
additional information on the items in this menu, see “Configuring TD4”
on page 19.
Chapter 2 Overview
12 OpenText™ Tableau™ Forensic TD4 Duplicator ISTD230100-UGD-EN-1

2.2.4 Job status
After a job starts, its job status screen is automatically displayed. This status screen
shows the details of a given job, including a header showing the job type, its status,
its start and end times, the overall data rate, time remaining, and percent complete.
The lower area of the job status screen shows additional job details, including hash
values (when available) sub-step progress (for example, Duplication separate from
Verification in a duplication/verification job), a settings summary, and the drives
involved in the job. Tapping a drive tile opens a drive details screen which provides
a quick view of all the information available for the drive. The fixed bottom area of
the job status screen includes buttons for exporting the forensic log and canceling
the job. An example of an active Duplication job status screen is shown below.
Note: If the detailed job status screen is closed, a brief summary of the job
status is still available in the expanded function tile on the home screen.
Tapping the lower portion of that function tile will reopen the detailed job
status screen. Also, when a job is running a circular spinner is shown in the top
navigation bar to the right of the TD4 model name. Tapping the spinner will
reopen the detailed job status screen.
2.2. Navigating TD4
ISTD230100-UGD-EN-1 User Guide 13

Once a job has completed, the job status screen is displayed and shows the final
status of that job. An example of a completed Duplication job status screen is shown
below.
2.2.5 Job history
Historical job status screens can be viewed from the Job History list. To access the
Job History list, expand the Job History function tile on the home screen. A
summary of the total jobs and cases (based on Case ID setting) will be shown in the
expanded function tile. Tap the lower portion of the expanded Job History function
tile to open the Job History list. The jobs in this list persist across power cycles. Any
active jobs will show in the list with an active blue progress bar. Successfully
completed jobs will show with a full green progress bar. Canceled jobs will show a
partially filled yellow progress bar. And failed jobs will show a partially filled red
progress bar. Tapping a specific job tile from the list will open the detailed job status
screen for that job. An example of a Job History list is shown below.
Chapter 2 Overview
14 OpenText™ Tableau™ Forensic TD4 Duplicator ISTD230100-UGD-EN-1

As can be seen at the top of the Job History screen above, the current case (as
identified by the Case ID system setting) is shown along with a count of the number
of different cases included in the Job History list.
In some situations, it may be convenient to view and manage (export or delete) only
a subset of jobs from the list. To filter the job list, tap on the filter icon near the
top-right side of the Job History screen. Filter criteria can be added to show only the
desired jobs. The jobs list can be filtered based on the following criteria:
Examiner name
Case ID
Job notes
Drive vendor
Drive model
Drive serial number
Simply tap the desired filter field(s) and enter the filter value(s). A count of how
many jobs matched the filter criteria will be shown near the top of the screen next to
the filter icon . Note that when multiple criteria are used, all must match for a job
2.2. Navigating TD4
ISTD230100-UGD-EN-1 User Guide 15

to show in the filtered list. The filter criteria section of the screen can be expanded
and collapsed by tapping on the filter icon .
Note: There is an easy way to filter the Job History list to show only jobs
associated with a specific drive. To do so, tap on the desired drive tile from the
home screen. Scroll to the Jobs summary section at the bottom of the drive
details screen, and then tap on the View button. A list of only the jobs
associated with that drive will be shown.
To export the logs associated with jobs in the Job History list, tap on the Export
button at the bottom-left of the Job History screen. Select the desired filesystem and
then tap the Export button at the bottom-right corner of the browse window.
To delete the jobs (and their associated logs) that are shown in the Job History list,
tap the Delete button at the bottom-right of the Job History screen and follow the
prompt.
Note: For both exportation and deletion of jobs/logs, whatever jobs are shown
in the Job History list are the ones that will be acted upon. If there are no filters
in place, then all jobs/logs will be exported or deleted. If a filter is used to show
only a subset of the overall jobs list, then only those filtered jobs/logs will be
exported or deleted.
Up to 100 jobs can be stored on TD4. When that limit is hit, the start of any
subsequent jobs will require acknowledgement that the oldest job will be
automatically deleted. In order to avoid that inefficient job startup step, it is
recommended that job logs be exported and jobs be deleted at the end of each case.
2.3 Reading the status LEDs
On/Off indicator LED: The illuminated power switch is located in the top-left
corner of TD4, and it displays a white LED when the unit is on.
DC In LED: The TP6 power supply cable has a blue LED ring near the end of the
barrel connector that indicates the TD4 power supply is receiving adequate DC
input power.
Activity LED: The multi-color activity LED is located in the lower-right corner of
TD4. It is white when the unit is booting up, blinking white when a power issue is
detected, off when the unit is on but idle, blue when an operation is in progress,
blinking green when an operation completes successfully, and blinking red when an
operation fails.
Chapter 2 Overview
16 OpenText™ Tableau™ Forensic TD4 Duplicator ISTD230100-UGD-EN-1

2.4 Interpreting audio feedback
TD4 plays one of two sounds that indicate status at the end of a job. A pleasant
chime sound with increasing pitch notes plays for a successful job. For a failed job,
the sound has decreasing pitch notes. You can change the volume of the sounds or
disable them on the Settings screen.
2.5 On-screen warnings
When appropriate, TD4 will provide on-screen warnings within various settings and
operations screens. Yellow warnings call the user's attention to a potential risk but
do not impede operations. Red warnings mean that a selected setting cannot be
accommodated, an operation has failed, or the potential exists for forensic evidence
to be missed, such as when a DCO or AMA is detected and not removed. Users are
encouraged to pay attention to and read any displayed warnings when they appear
and proceed accordingly.
2.6 USB keyboard and mouse support
You can plug a standard, English language USB keyboard and/or mouse into any
TD4 USB port. (While the Accessory port on the rear of TD4 is intended for this
purpose, any USB port will work.) You may find it more convenient to use an
external keyboard and/or mouse to navigate the UI and enter data instead of using
the touchscreen and virtual keyboard. Wireless keyboard/mouse adapters are
supported as well, including unified adapters.
Notes
• TD4 supports wireless keyboards and mice. To use a wireless keyboard or
mouse, simply plug the USB wireless adapter into the TD4’s rear USB
accessory port, and it should automatically pair with the keyboard and start
working. There are many vendors of wireless keyboards and mice, and some
may not be compatible with TD4. If you prefer to use a wireless keyboard or
mouse and yours is not working with TD4, contact OpenText Customer
Support for keyboard recommendations.
• If you are using a wireless unified keyboard/mouse adapter with only a
mouse, the virtual keyboard may not appear on the TD4 screen for data
entry situations. TD4 will see the wireless adapter as the keyboard which
makes it want to hide the virtual keyboard in data entry situations. To
accommodate this use case, a Virtual Keyboard system setting has been
added to allow the virtual keyboard to always be shown when entering data.
This setting will be off by default, which means that the virtual keyboard
will not appear if a USB keyboard is detected.
2.4. Interpreting audio feedback
ISTD230100-UGD-EN-1 User Guide 17

Chapter 3
Configuring TD4
This chapter describes the steps to configure TD4 prior to using it on a regular basis.
3.1 Startup sequence
When turned on, TD4 displays an initialization screen during the boot sequence. The
initial boot cycle (after a factory reset) will show a setup wizard that brings out key
system settings to make it easy to configure your TD4 for use. Interacting with that
setup wizard screen (by closing it or tapping the Full Settings button) will prevent it
from appearing in future boot cycles. Once booted past the setup wizard screen, TD4
displays the home screen and then sequentially powers on and detects connected
drives and mounts any supported filesystems.
3.2 Configuring TD4
TD4 default settings are defined using sensible, best-practice values. There are many
options and settings you can configure and customize to your specific needs. Tap the
System Navigation Menu icon in the upper left corner of the user interface to
access the System Navigation Menu, which includes following items:
Home: Return to the home screen.
Settings: Access the System Settings screen.
Administration: Access the Administration setup screen.
Lock System: Lock the screen with a PIN to prevent access while unattended.
About: Access the About screen to view additional information such as the unit
serial number, firmware version/hash, copyright, and licensing information.
Firmware update and factory reset are also initiated from this screen.
3.2.1 Settings
Tap Settings to display the Settings screen.
ISTD230100-UGD-EN-1 User Guide 19

The screenshot above shows the TD4 Settings screen. Each setting and its options
and default values are described below.
Hashes: Allows selection of the desired hash calculations for your Duplicate, Logical
Imaging, and Hash jobs. The options are MD5, SHA-1, SHA-256, and Prompt.
Selecting Prompt will allow the hashes to be chosen at job startup time. The default
hash selections are MD5 and SHA-1.
‘Duplicate’ File Type: Allows selection of the output file type for Duplicate
(physical image) jobs. The options are: Ex01, E01, DD, DMG and Prompt. Selecting
Prompt will allow the file type to be chosen at job startup time. The default setting is
Ex01.
Max File Size: Allows selection of the desired maximum output file segment size.
The options are: 2 GB, 4 GB, 8 GB, and Unlimited. The default setting is Unlimited.
Error Recovery: Allows selection of the Recovery Mode and Retry Count for when
source drive read errors are encountered during Duplicate and Hash jobs.
Recovery Mode: This determines the size of reads that will be used to find readable
data within regions that have errors. The options are: Standard and Exhaustive.
Standard mode means that error recovery attempts will read blocks of data that are
always 32,768 bytes. In Exhaustive mode, error recovery reads will occur down to
Chapter 3 Configuring TD4
20 OpenText™ Tableau™ Forensic TD4 Duplicator ISTD230100-UGD-EN-1