OPENTEXT Tableau TX1 User manual

OpenText Tableau
Forensic TX1 Imager
User Guide
Copyright © 2022 Open Text. All rights reserved. Trademarks owned by Open Text.

Contents
1Preface ......................................................................................................... 5
1.1 Drive capacity and transfer rate measurement conventions.................... 5
2Overview ...................................................................................................... 5
2.1 TX1 kit contents..................................................................................... 8
2.2 Navigating TX1 .................................................................................... 10
2.2.1 Home screen ............................................................................. 10
2.2.2 Side navigation menu................................................................. 12
2.2.3 Jobs tab..................................................................................... 12
2.2.4 Job status .................................................................................. 14
2.2.5 Quick Reference Guide.............................................................. 16
2.3 Reading the status LEDs ..................................................................... 17
2.4 Interpreting audio feedback.................................................................. 17
2.5 On-screen warnings............................................................................. 17
2.6 USB keyboard support......................................................................... 18
2.7 Configuring TX1................................................................................... 18
2.8 Startup sequence................................................................................. 18
3Configuring TX1......................................................................................... 18
3.1 Startup sequence................................................................................. 18
3.2 Configuring TX1................................................................................... 18
3.2.1 System settings ......................................................................... 19
3.2.2 Network settings ........................................................................ 22
3.2.3 Default settings .......................................................................... 28
3.2.4 User management ..................................................................... 30
3.2.5 Locking the system .................................................................... 32
3.2.6 Updating TX1 firmware .............................................................. 33
3.3 Media utilities....................................................................................... 37
3.3.1 Content breakdown.................................................................... 37
3.3.2 Wiping destination or accessory drives....................................... 40
3.3.3 Formatting destination and accessory drives .............................. 46
3.3.4 Tableau encryption management ............................................... 47
3.3.5 Encryption unlock....................................................................... 48
3.3.6 Disabling drive capacity limiting configurations ........................... 51
3.3.7 Blank checking........................................................................... 55
3.3.8 Browse filesystem...................................................................... 56
3.3.9 SMART data .............................................................................. 57
3.3.10Export........................................................................................ 58
3.3.11Eject .......................................................................................... 60
3.4 Connecting drives ................................................................................ 61
3.4.1 Source drives............................................................................. 61
3.4.2 Destination drives ...................................................................... 61
3.4.3Accessory drives........................................................................ 62
3.4.4 Drive detection........................................................................... 62
4Using TX1................................................................................................... 63
4.1 Navigating TX1 features and options.................................................... 63
4.1.1 Home screen ............................................................................. 64
4.1.2 Jobs screen ............................................................................... 64
Copyright © 2022 Open Text. All rights reserved. Trademarks owned by Open Text.

OpenText Tableau Forensic TX1 Imager
The Information Company 3
4.1.3 Side navigation menu................................................................. 64
4.2 Preconditions checking ........................................................................ 64
4.3 Duplicating........................................................................................... 64
4.3.1 Cloning ...................................................................................... 65
4.3.2 Imaging...................................................................................... 65
4.3.3 Performing a duplication............................................................. 66
4.3.4 Using automated acquisition ...................................................... 74
4.3.5 Duplication over a network ......................................................... 82
4.3.6 Pausing and resuming a duplication job ..................................... 94
4.4 Hashing ............................................................................................. 102
4.5 Logical imaging.................................................................................. 105
4.5.1 Performing a logical image acquisition ..................................... 106
4.5.2 Include/exclude criteria ............................................................ 117
4.5.3 About the logical imaging process ............................................ 123
4.5.4 File extensions......................................................................... 127
4.5.5 Folders .................................................................................... 128
4.5.6 Source file metadata ................................................................ 129
4.6 Verifying ............................................................................................ 130
4.7 Browsing............................................................................................ 134
4.7.1 Viewing text and image files..................................................... 135
4.8 Restoring ........................................................................................... 137
4.9 Viewing sources and destinations ...................................................... 142
4.9.1 Encryption detection................................................................. 146
4.9.2 RAID detection......................................................................... 151
4.10 Logs module ...................................................................................... 154
4.10.1HTML logs ............................................................................... 157
4.10.2Sample logs............................................................................. 157
4.10.3Filtering logs ............................................................................ 162
4.11 Remote web interface ........................................................................ 163
4.11.1SSL certificate setup and installation........................................ 164
4.11.2Accessing TX1 remotely........................................................... 166
5Adapters .................................................................................................. 169
5.1 PCIe SSD adapters ........................................................................... 170
5.2 PCIe IDE adapter (TDA7–5)............................................................... 170
5.2.1 Using the TDA7-5 .................................................................... 170
5.3 PCIe FireWire adapter (TDA7–9) ....................................................... 171
5.4 Apple Target Disk Mode acquisition adapters..................................... 171
5.4.1 USB-C to USB-A adapter cable................................................ 172
5.4.2 FireWire adapter cable............................................................. 172
5.4.3 Thunderbolt 2 adapter cable..................................................... 173
6Specifications and troubleshooting ....................................................... 173
6.1 Specifications .................................................................................... 173
Copyright © 2022 Open Text. All rights reserved. Trademarks owned by Open Text.

4 The Information Company
6.2 Troubleshooting common problems ................................................... 175
6.2.1 Power supply issues ................................................................ 175
6.2.2 Thermal issues ........................................................................ 176
6.2.3 Problems with drive detection................................................... 176
6.2.4 Problems detecting Apple devices in target disk mode ............. 177
6.2.5 Long time to complete locally initiated firmware update ............ 179
6.2.6 Real-time clock data retention issue......................................... 179
About OpenText........................................................................................ 180
Copyright © 2022 Open Text. All rights reserved. Trademarks owned by Open Text.

OpenText Tableau Forensic TX1 Imager
The Information Company 5
1 Preface
This guide presents a wide range of technical information and procedures for using the
Tableau Forensic TX1 Imager, a product of OpenText. It is divided into the following
chapters:
•Overview: Provides general information about TX1 as well as unpacking, starting up,
and navigating TX1 menus and reading the LEDs.
•Configuring TX1: Provides system overview information about TX1 as well as
procedures for configuring and connecting it.
•Using TX1: Provides detailed information and procedures for TX1 operation.
•Adapters: Describes the adapters that extend the drive acquisition options and
destination drive capabilities of TX1.
•Specifications and troubleshooting: Provides a brief list of potential problems and
solutions. For more complete and current troubleshooting information as well as
answers to frequently asked questions (FAQ), visitOpenText My Support
(https://support.opentext.com/).
1.1 Drive capacity and transfer rate
measurement conventions
The computer industry generally adheres to two different conventions for definitions of
the terms megabyte (MB) and gigabyte (GB). For computer RAM, 1 MB is defined as
2^20 = 1,048,576 bytes and 1 GB is defined as 2^30 = 1,073,741,824 bytes. For drive
storage, 1 MB is defined as 10^6 = 1,000,000 bytes and 1 GB is defined as 10^9 =
1,000,000,000 bytes. These two conventions are known as powers of two and powers of
ten respectively. Microsoft deviates from the hard drive capacity measurement
convention and uses the powers of two convention for its operating systems.
Tableau products report drive capacities and transfer rates according to the industry
standard powers of ten convention. In TX1 screens, reports, and documentation, a 4 GB
hard drive stores up to 4,000,000,000 bytes; a hard drive with a 150 MB/sec transfer rate
transfers 150,000,000 bytes per second.
2 Overview
Tableau TX1 is a powerful, yet intuitive, forensic imager that offers superior local and
networked imaging performance with no compromises. The touch screen user interface is
easy to use and provides a familiar user experience similar to modern tablets and
smartphones. TX1 is custom built for forensics and provides many standard and
advanced features that serve the specialized needs of digital forensics and incident
response practitioners, including:

6 The Information Company
•Acquisition of PCIe, USB 3.0, SATA, SAS, FireWire, IDE, and network shares (iSCSI
and CIFS). Note: PCIe and IDE adapters (sold separately) are required to image
these drive types.
•Output to USB 3.0, SATA, SAS, and network shares (iSCSI and CIFS).
•The ability to target file-based evidence with a powerful logical imaging function,
including an intelligent, easy to use search engine with wildcard support and industry
standard file outputs (lx01 and metadata csv files).
•The ability to save, import, and export logical imaging search criteria.
•The ability to automatically acquire any drives connected to the source ports on TX1
based on predefined job settings.
•The ability to enable and configure 802.1X network authentication to strengthen
network access security.
•The ability to export locally attached media as an iSCSI share for remote, network-
based acquisition.
•Support for cableless, toolless, SATA or SAS destination drive connections via the
optional drive bay (TX1-S1), which also provides drive cooling.
•The ability to duplicate a source drive to up to four destination drives.
•Destination drives that can be a mix of directly connected drives and network shares.
•The ability to run multiple jobs in parallel of any type (clone, physical image, or logical
image) to any available destination media.
•The ability to run up to two forensic jobs simultaneously at full speed, and to add
additional jobs to the queue and reorder them.
•The ability to pause and resume imaging jobs, including resumption from power loss
and certain types of job failures.
•The ability to prevent damage to disk drives by spinning them down when they are
ejected from TX1 prior to physical removal.
•Browser based remote user interface to any number of network connected TX1s, with
the ability to directly download selected files to the remote system.
•User management – create, delete, and manage user profiles.
•Superior network imaging performance through a 10 gigabit Ethernet interface, with
auto-negotiation for use with slower 1 gigabit Ethernet networks.
•Superior data transfer rates, even while performing calculations of MD5, SHA-1, and
SHA-256 hash values on two active jobs.
•Viewing extensive drive detail, including partition and filesystem information and raw
hex data.
•Detection and notification of many popular encryption types (whole disk and volume
based), RAID types, proprietary self-encrypting drives, and Apple device Core
Storage volumes.
•The ability to unlock Opal-compliant self-encrypting drives (SEDs) and BitLocker-
encrypted drives/partitions to enable unencrypted source media acquisition, and as
an alternative to Tableau encryption for destination/accessory port media.
•The ability to unlock APFS-encrypted volumes to enable unencrypted source media
acquisition (source ports only).
•Browsing drive filesystems, with the ability to view image and text files directly in TX1
user interface.
Copyright © 2022 Open Text. All rights reserved. Trademarks owned by Open Text.

OpenText Tableau Forensic TX1 Imager
The Information Company 7
•Extensive filesystem support - APFS, ExFAT, NTFS, EXT4, FAT(12/16/32), and
HFS+.
•Whole disk, open standard, destination drive encryption using XTS-AES.
•Automatic blank checking of source and destination drives.
•Comprehensive destination/accessory drive wiping capabilities, including NIST 800-
88 compliant wipes and the ability to specify a custom wipe pattern.
•HPA, DCO, and AMA support for the detection and handling of hidden/protected data
areas on source drives. This includes standalone HPA/DCO/AMA disablement,
DCO/AMA “shelving”, and trim support for the creation of a destination DCO or AMA.
•The ability to update system time via an NTP server.
•Detailed forensic logs for case documentation in text and HTML formats.
•The ability to filter the forensic log list to only show logs of interest based on specific
case and/or drive information. The filtered logs can also be exported or deleted.
•Always free firmware update support via Tableau Firmware Update (TFU) on a host
system, via TX1 file browsing of any mounted filesystem (local drive or network
share), or via the remote user interface.
•Clearly labeled and color-coded source (write blocked) and destination (read/write)
ports.
•User interface localization support for German, English, Spanish French, Korean,
Portuguese, Turkish, and Chinese languages, including virtual keyboard support for
user inputs.
Copyright © 2022 Open Text. All rights reserved. Trademarks owned by Open Text.

8 The Information Company
TX1 can operate as a standalone device, as shown above.
Optionally, TX1 can operate with the destination imaging bay (TX1-S1), as shown above.
The left source (write blocked) side of TX1.
The right destination (read/write) side of TX1.
2.1 TX1 kit contents
TX1 ships in a boxed kit with custom foam that includes the following items:
Copyright © 2022 Open Text. All rights reserved. Trademarks owned by Open Text.

OpenText Tableau Forensic TX1 Imager
The Information Company 9
Item
Model #
Description
TX1
TX1 Forensic Imager
TX1-S1
Optional destination drive bay for
up to two 2.5” or 3.5” SATA or SAS
drives
TP6
Provides power to TX1, the
optional TX1-S1 Drive Bay, and
most common combinations of
source and destination drives.
Uses a universal 3-prong style AC
line cord and is compatible with
100-240V AC line voltages
worldwide.
TC4-8-R3
Unified SATA/SAS signal and
power to 8” SATA/SAS signal and
8” 3M power cable (4 pieces).
TC-PCIE-8
8” PCIe adapter cable. Must be
used with a Tableau PCIe adapter.
TPKG-VCT-5
Five piece Velcro cable tie kit
TPKG-CLOTH
Microfiber screen cleaning cloth
Copyright © 2022 Open Text. All rights reserved. Trademarks owned by Open Text.

10 The Information Company
Item
Model #
Description
Quick Reference Guide
Do not discard the TX1 foam packaging, as it is designed to fit several industry-standard
hard sided carrying cases (for example, the Pelican 1500). If you received the TX1 kit in
the cardboard box shipped by OpenText, you can reuse the stacking foam inserts in your
own hard sided case.
2.2 Navigating TX1
Use the TX1 touchscreen display to navigate from module to module and choose or
modify options. Use the touchscreen keyboard or a USB keyboard to enter alphanumeric
text when prompted. See “USB keyboard support” on page 5.
2.2.1 Home screen
The Home screen of TX1 displays icons for initiating the following functions:
•Duplicate
•Logical
•Verify
•Hash
•Browse
•Restore
Copyright © 2022 Open Text. All rights reserved. Trademarks owned by Open Text.