OPENTEXT Tableau Forensic TD4 User manual

OpenText™ Tableau™ Forensic TD4
Duplicator
User Guide
This guide presents a wide range of technical information and
procedures for using the OpenText Tableau Forensic TD4
Duplicator.
ISTD230100-UGD-EN-1

OpenText™ Tableau™ Forensic TD4 Duplicator
User Guide
ISTD230100-UGD-EN-1
Rev.: 2023-Mar-06
This documentation has been created for OpenText™ Tableau™ Forensic TD4 Duplicator 23.1.
It is also valid for subsequent software releases unless OpenText has made newer documentation available with the product,
on an OpenText website, or by any other means.
Open Text Corporation
275 Frank Tompa Drive, Waterloo, Ontario, Canada, N2L 0A1
Tel: [phone]
Toll Free Canada/USA: 1-800-499-6544 International: [phone]
Fax: [phone]
Support: https://support.opentext.com
For more information, visit https://www.opentext.com
Copyright © 2023 Open Text. All Rights Reserved.
Trademarks owned by Open Text.
One or more patents may cover this product. For more information, please visit https://www.opentext.com/patents.
Disclaimer
No Warranties and Limitation of Liability
Every effort has been made to ensure the accuracy of the features and techniques presented in this publication. However,
Open Text Corporation and its affiliates accept no responsibility and offer no warranty whether expressed or implied, for the
accuracy of this publication.

Table of Contents
1 Preface ........................................................................................ 5
1.1 Drive capacity and transfer rate measurement conventions .................. 5
2 Overview ..................................................................................... 7
2.1 TD4 kit contents ................................................................................ 9
2.2 Navigating TD4 ............................................................................... 10
2.2.1 Home screen .................................................................................. 10
2.2.2 Drive details .................................................................................... 12
2.2.3 System navigation menu ................................................................. 12
2.2.4 Job status ....................................................................................... 13
2.2.5 Job history ...................................................................................... 14
2.3 Reading the status LEDs ................................................................. 16
2.4 Interpreting audio feedback .............................................................. 17
2.5 On-screen warnings ........................................................................ 17
2.6 USB keyboard and mouse support ................................................... 17
3 Configuring TD4 ...................................................................... 19
3.1 Startup sequence ............................................................................ 19
3.2 Configuring TD4 .............................................................................. 19
3.2.1 Settings .......................................................................................... 19
3.2.2 Administration ................................................................................. 22
3.2.3 Locking the system ......................................................................... 25
3.2.4 Updating TD4 firmware .................................................................... 26
3.3 Connecting drives ........................................................................... 27
3.3.1 USB versions and connector types ................................................... 27
3.3.2 Drive adapters ................................................................................ 28
3.3.3 Drive tiles ....................................................................................... 28
3.3.4 Source drives .................................................................................. 28
3.3.5 Destination drives ........................................................................... 29
3.3.6 Accessory drives ............................................................................. 29
3.3.7 Drive detection ................................................................................ 30
4 Using TD4 ................................................................................. 31
4.1 Home screen .................................................................................. 31
4.2 Drive details .................................................................................... 33
4.3 System navigation menu ................................................................. 33
4.4 Job status ....................................................................................... 34
4.5 Job history ...................................................................................... 35
4.6 Viewing sources and destinations .................................................... 37
4.6.1 Blank check .................................................................................... 40
4.6.2 Reconfigure .................................................................................... 40
ISTD230100-UGD-EN-1 User Guide iii

4.6.2.1 Remove sector limitations ................................................................ 41
4.6.2.2 Volatile HPA removal ...................................................................... 42
4.6.2.3 Non-volatile HPA/DCO/AMA removal ............................................... 44
4.6.2.4 Wiping destination or accessory drives ............................................. 46
4.6.2.5 Encrypting destination and accessory drives ..................................... 49
4.6.2.6 Formatting destination and accessory drives ..................................... 50
4.6.3 Opal encryption ............................................................................... 50
4.7 Browsing ........................................................................................ 52
4.8 Case information ............................................................................. 53
4.9 Duplicating ..................................................................................... 53
4.9.1 Cloning ........................................................................................... 54
4.9.2 Imaging .......................................................................................... 54
4.9.3 Performing a duplication .................................................................. 55
4.9.4 Files created during disk-to-file duplication ........................................ 59
4.10 Logical imaging ............................................................................... 60
4.10.1 Performing a logical image .............................................................. 61
4.10.2 Files created during a logical image job ............................................ 65
4.10.3 Logical image verification ................................................................. 65
4.10.4 Source file metadata ....................................................................... 65
4.11 Hashing .......................................................................................... 66
4.12 Verifying ......................................................................................... 68
4.13 Restoring ........................................................................................ 69
4.14 Forensic logs .................................................................................. 70
4.14.1 Sample logs .................................................................................... 71
5 Adapters ................................................................................... 77
5.1 PCIe SSD adapters ......................................................................... 77
5.2 PCIe IDE adapter (TDA7‒5) ............................................................ 77
5.3 PCIe FireWire adapter (TDA7‒9) ..................................................... 78
5.4 SATA/IDE adapters ......................................................................... 78
6 Specifications and troubleshooting ...................................... 81
6.1 Specifications ................................................................................. 81
6.2 Troubleshooting common problems .................................................. 82
6.2.1 Firmware recovery .......................................................................... 83
6.2.2 Power supply issues ........................................................................ 84
6.2.3 Thermal issues ............................................................................... 84
6.2.4 Problems with drive detection .......................................................... 85
6.2.5 Real-time clock data retention issue ................................................. 86
Table of Contents
iv OpenText™ Tableau™ Forensic TD4 Duplicator ISTD230100-UGD-EN-1

Chapter 1
Preface
This guide presents a wide range of technical information and procedures for using
the OpenText Tableau Forensic TD4 Duplicator, a product of OpenText. It is divided
into the following chapters:
Overview: Provides general information about TD4 as well as unpacking, starting
up, and navigating TD4 menus and reading the LEDs.
Configuring TD4: Provides system overview information about TD4 as well as
procedures for configuring and connecting it.
Using TD4: Provides detailed information and procedures for TD4 operation.
Adapters: Describes the adapters that extend the drive acquisition options and
destination drive capabilities of TD4.
Specifications and troubleshooting: Provides TD4 specifications and a brief list of
potential problems and solutions. For more complete and current troubleshooting
information as well as answers to frequently asked questions (FAQ), visit OpenText
My Support (https://support.opentext.com).
1.1 Drive capacity and transfer rate measurement
conventions
The computer industry generally adheres to two different conventions for
definitions of the terms megabyte (MB) and gigabyte (GB). For computer RAM, 1
MB is defined as 220 = 1,048,576 bytes and 1 GB is defined as 230 = 1,073,741,824
bytes. For drive storage, 1 MB is defined as 106 = 1,000,000 bytes and 1 GB is defined
as 109 = 1,000,000,000 bytes. These two conventions are known as powers of two and
powers of ten respectively. Microsoft deviates from the hard drive capacity
measurement convention and uses the powers of two convention for its operating
systems.
Tableau products report drive capacities and transfer rates according to the industry
standard powers of ten convention. In TD4 screens, reports, and documentation, a 4
GB hard drive stores up to 4,000,000,000 bytes; a hard drive with a 150 MB/sec
transfer rate transfers 150,000,000 bytes per second.
ISTD230100-UGD-EN-1 User Guide 5

Chapter 2
Overview
Tableau TD4 is a powerful and intuitive forensic duplicator that offers valuable,
high-performance imaging capabilities in a small, portable package. The touch
screen user interface is easy to use and provides a familiar user experience similar to
modern tablets and smartphones. TD4 is custom built for forensics and provides
many standard and advanced features that serve the specialized needs of digital
forensics practitioners, including:
Acquisition of PCIe, USB, SATA, SAS, FireWire, and IDE drives.
Note: PCIe, IDE, and FireWire adapters (sold separately) are required to image
these drive types.
Output to PCIe, USB, and SATA drives.
The ability to target file-based evidence with logical imaging functionality and
industry standard file outputs (lx01 and metadata csv files).
The ability to duplicate a source drive to up to five destination drives.
The ability to prevent damage to disk drives by spinning them down when they are
ejected from TD4 prior to physical removal.
The ability to lock specific functions and settings with an administrator PIN to
enforce standard settings and procedures for your forensic acquisition jobs.
Superior data transfer rates, even while performing calculations of MD5, SHA-1, and
SHA-256 hash values.
The ability to view extensive drive detail, including partition and filesystem
information.
Browsing drive filesystems.
Extensive filesystem support - APFS, ExFAT, NTFS, EXT4, FAT(12/16/32), and HFS+.
Whole disk, open standard, destination drive encryption using XTS-AES.
The ability to detect and inform of the presence of enabled Opal encryption.
Comprehensive destination and accessory drive wiping capabilities, including NIST
800-88 compliant wipes.
HPA, DCO, and AMA support for the detection and handling of hidden/protected
data areas on source drives. This includes standalone HPA/DCO/AMA disablement,
DCO/AMA “shelving,” and trim support for the creation of a destination DCO or
AMA.
Detailed forensic logs in HTML format for case documentation.
The ability to filter the forensic log list to only show logs of interest based on specific
case and/or drive information. The filtered logs can also be exported or deleted.
ISTD230100-UGD-EN-1 User Guide 7

Always free firmware update support.
Clearly labeled and color-coded source (write blocked) and destination (read/write)
ports.
The left source (write blocked) side of TD4.
The right destination (read/write) side of TD4.
Chapter 2 Overview
8OpenText™ Tableau™ Forensic TD4 Duplicator ISTD230100-UGD-EN-1

2.1 TD4 kit contents
TD4 ships in a boxed kit with custom foam that includes the following items:
Item Model # Description
TD4 OpenText Tableau Forensic
TD4 Duplicator
TP6 Provides power to TD4. Uses
a universal 3-prong style AC
line cord and is compatible
with 100-240V AC line
voltages worldwide.
TC4-8-R4 Unified SATA/SAS signal
and power to 8in. SATA/SAS
signal and 8in. power cable
(qty 3)
TC-PCIE-8 8in. PCIe adapter cable. Must
be used with a Tableau PCIe
adapter (qty 1)
TCA-USB3-AC USB Type A female to Type C
male adapter cable (qty 2)
TPKG-VCT-5 5-piece Velcro cable tie kit
TPKG-CLOTH Microfiber screen cleaning
cloth
Quick Reference Guide
2.1. TD4 kit contents
ISTD230100-UGD-EN-1 User Guide 9

Do not discard the TD4 foam packaging, as it is designed to fit several industry-
standard hard sided carrying cases (for example, the Pelican 1500). If you received
the TD4 kit in the cardboard box shipped by OpenText, you can reuse the stacking
foam inserts in your own hard-sided case.
2.2 Navigating TD4
Use the TD4 touchscreen display to navigate the available TD4 functions. Use the
onscreen virtual keyboard or a USB keyboard to enter alphanumeric text when
prompted. See “USB keyboard and mouse support” on page 17.
2.2.1 Home screen
The home screen of TD4 displays function tiles for initiating the following forensic
jobs:
Duplicate
Logical Image
Hash
Verify
Restore
It also includes tiles for entering/viewing essential information, as follows:
Case Info
Job History
Chapter 2 Overview
10 OpenText™ Tableau™ Forensic TD4 Duplicator ISTD230100-UGD-EN-1