Tableau TX1 User manual

USER GUIDE
Tableau TX1
Version 2.0

Tableau TX1 User Guide
Rev.: 9/28/2018
This documentation has been created for software version 2.0.
It is also valid for subsequent software versions as long as no new document version is shipped with the product or is published at
https://knowledge.opentext.com.
Open Text Corporation
275 Frank Tompa Drive, Waterloo, Ontario, Canada, N2L 0A1
Tel: [phone]
Toll Free Canada/USA: 1-800-499-6544 International: [phone]
Fax: [phone]
Support: https://support.opentext.com
For more information, visit https://www.opentext.com
Copyright © 2018 Open Text. All Rights Reserved.
Trademarks owned by Open Text.
One or more patents may cover this product. For more information, please visit, https://www.opentext.com/patents
Disclaimer
No Warranties and Limitation of Liability
Every effort has been made to ensure the accuracy of the features and techniques presented in this publication. However, Open
Text Corporation and its affiliates accept no responsibility and offer no warranty whether expressed or implied, for the accuracy
of this publication.

CONTENTS
CHAPTER 1 Preface 7
About this Guide 8
Drive Capacity and Transfer Rate Measurement
Conventions 8
CHAPTER 2 Overview 9
Tableau TX1 10
TX1 Kit Contents 12
Navigating the TX1 14
Home Screen 14
Side Navigation Menu 16
Jobs Tab 16
Job Status 17
Quick Reference Guide 19
Reading the Status LEDs 19
Interpreting Audio Feedback 20
On-screen Warnings 20
USB Keyboard Support 21
CHAPTER 3 Configuring the TX1 23
Startup Sequence 24
- iii -

Configuring the TX1 24
System Settings 24
Network Settings 26
Default Settings 27
Updating TX1 Firmware 29
Connecting Drives 30
Source Drives 30
Destination Drives 31
Accessory Drives 31
Drive Detection 31
CHAPTER 4 Using the TX1 33
Overview 34
Navigating TX1 Features and Options 34
Home Screen 34
Jobs screen 34
Side Navigation menu 34
Preconditions Checking 35
Duplicating 35
Cloning 35
Imaging 35
Performing a Duplication 36
Duplication Over a Network 45
Hashing 54
Logical Imaging 57
Performing a Logical Image Acquisition 58
File Extensions 75
Folders 79
Source File Metadata 79
Verifying 80
Browsing 84
Restore 85
- iv -

Viewing Sources and Destinations 89
Encryption Detection 91
Media Utilities 93
Wiping Destination or Accessory Drives 93
Formatting Destination and Accessory Drives 95
Encryption 95
Disabling HPA and DCO 97
Blank Checking 100
Browse Filesystem 102
SMART Data 102
Export 103
Eject 105
Logs Module 105
Sample Log 107
CHAPTER 5 Adapters 111
Overview 112
IDE Adapter 112
Using the TDA7-5 112
PCIe Adapters 113
Apple Target Disk Mode Acquisition Adapters 113
CHAPTER 6 Specifications, Troubleshooting, and Support 117
Specifications 118
Troubleshooting Common Problems 120
Power Supply Issues 120
Problems with Drive Detection 120
Support 121
Index 123
- v -

- vi -

CHAPTER 1
PREFACE
About this Guide 8
Drive Capacity and Transfer Rate Measurement
Conventions 8

About this Guide
This guide presents a wide range of technical information and procedures for using the Tableau
TX1 Forensic Imager, a product of Guidance Software. It is divided into the following chapters:
lOverview: Provides general information about the TX1 as well as unpacking, starting up,
and navigating the TX1 menus and reading the LEDs.
lSetting up the TX1: Provides system overview information about the TX1 as well as pro-
cedures for configuring and connecting the TX1.
lUsing the TX1: Provides detailed information and procedures for TX1 operation.
lDrive Bay and Adapters: Describes the drive bay and adapters that extend the drive
acquisition options and destination drive capabilities of the TX1.
lTroubleshooting and Support: Provides a brief list of potential problems and solutions.
For more complete and current troubleshooting information as well as answers to fre-
quently asked questions (FAQ), visit OpenText My Support at https://sup-
port.opentext.com.
Drive Capacity and Transfer Rate Measurement
Conventions
The computer industry generally adheres to two different conventions for definitions of the
terms megabyte (MB) and gigabyte (GB). For computer RAM, 1 MB is defined as 220 =
1,048,576 bytes and 1 GB is defined as 230 = 1,073,741,824 bytes. For drive storage, 1 MB is
defined as 106= 1,000,000 bytes and 1 GB is defined as 109= 1,000,000,000 bytes. These two
conventions are known as powers of two and powers of ten respectively. Microsoft deviates
from the hard drive capacity measurement convention and uses the powers of two
convention for its operating systems.
Tableau products report drive capacities and transfer rates according to the industry standard
powers of ten convention. In TX1 screens, reports, and documentation, a 4 GB hard drive
stores up to 4,000,000,000 bytes; a hard drive with a 150 MB/sec transfer rate transfers
150,000,000 bytes per second.
8 Tableau TX1 User Guide Version 2.0

CHAPTER 2
OVERVIEW
TOPICS IN THIS CHAPTER:
Tableau TX1 10
TX1 Kit Contents 12
Navigating the TX1 14
Reading the Status LEDs 19
Interpreting Audio Feedback 20
On-screen Warnings 20
USB Keyboard Support 21

Tableau TX1
The Tableau TX1 is a powerful, yet intuitive, forensic imager that offers superior local and
networked imaging performance with no compromises. The touch screen user interface is easy
to use and provides a familiar user experience similar to modern tablets and smartphones. The
TX1 is custom built for forensics, and provides many standard and advanced features that
serve the specialized needs of digital forensics and incident response practitioners, including:
lAcquisition of PCIe, USB 3.0, SATA, SAS, FireWire, IDE, and network shares (iSCSI and
CIFS).
Note: PCIe and IDE adapters (sold separately) are required to image these drive
types.
lThe ability to target file-based evidence with a powerful logical imaging function, including
an intelligent, easy to use search engine and industry standard file outputs (Lx01 and
metadata CSV files).
lOutput to USB 3.0, SATA, SAS, and network shares (iSCSI and CIFS).
lThe ability to export locally attached media as an iSCSI share for remote, network based
acquisition.
lSupport for cableless, toolless, SATA or SAS destination drive connections via the optional
drive bay (TX1-S1), which also provides drive cooling.
lThe ability to duplicate a source drive to up to four destination drives.
lDestination drives that can be a mix of directly connected drives and network shares.
lThe ability to run multiple jobs in parallel of any type (clone, physical image, or logical
image) to any available destination media.
lThe ability to run up to two forensic jobs simultaneously and add additional jobs to the
queue.
lSuperior network imaging performance through a 10 gigabit Ethernet interface, with
auto-negotiation for use with slower 1 gigabit Ethernet networks.
lSuperior data transfer rates, even while performing calculations of MD5, SHA-1, and SHA-
256 hash values.
lViewing extensive drive detail, including filesystem information and available free space.
lDetection and notification of many popular whole disk encryption types.
lBrowsing drive filesystems.
lExtensive filesystem support - ExFAT, NTFS, EXT4, FAT32, and HFS+.
lWhole-disk, open standard, destination drive encryption using XTS-AES.
lAutomatic blank checking of source and destination drives.
10 Tableau TX1 User Guide Version 2.0

lHPA and DCO support for the detection and handling of hidden/protected data areas on
source drives. This includes standalone HPA/DCO disabling, temporary DCO “shelving”,
and optional trim support for the creation of a destination DCO.
lDetailed forensic logs for case documentation.
lClearly labeled and color coded source (write blocked) and destination (read/write) ports.
lUser interface localization support for German, English, Spanish, French, Portuguese, Rus-
sian, Turkish, and Chinese languages, including virtual keyboard support for user inputs.
The TX1 can operate as a standalone device, as shown above.
Optionally, the TX1 can operate with the destination imaging bay (TX1-S1), as shown above.
CHAPTER 2 Overview 11

The left source (write blocked) side of TX1.
The right destination (read/write) side of TX1.
TX1 Kit Contents
The TX1 ships in a boxed kit with custom foam that includes the following items:
12 Tableau TX1 User Guide Version 2.0

Item Model
#Description
TX1 TX1 Forensic Imager.
TX1-S1 Optional destination drive bay for up to two 2.5” or
3.5” SATA or SAS drives.
TP6
The TP6 provides power to the TX1, the optional
TX1-S1 Drive Bay, and most common combinations
of source and destination drives. The TP6 uses a
universal 3-prong style AC line cord and is
compatible with 110-240V AC line voltages
worldwide.
TC4-8-
R3
Unified SATA/SAS signal and power to 8"
SATA/SASsignal and 8" 3M power cable (4 pieces).
TC-
PCIE-8
8" PCIe adapter cable. Must be used with a Tableau
PCIe adapter.
TPKG-
VCT-5 Five piece Velcro cable tie kit.
TPKG-
CLOTH Microfiber screen cleaning cloth.
CHAPTER 2 Overview 13

Item Model
#Description
Quick Reference Guide.
Do not discard the TX1 foam packaging, as it is designed to fit several industry-standard hard
sided carrying cases(for example, the Pelican 1500). If you received the TX1 kit in the
cardboard box shipped by Tableau, you can reuse the stacking foam inserts in your own hard
sided case.
Navigating the TX1
Use the TX1 touchscreen display to navigate from module to module and choose or modify
options. Use the touchscreen keyboard or a USB keyboard to enter alphanumeric text when
prompted. See USB Keyboard Support on page1.
Home Screen
The Home screen of the TX1 displays icons for initiating the following functions:
lDuplicate
lLogical
lVerify
lHash
lBrowse
lRestore
14 Tableau TX1 User Guide Version 2.0

Tap one of these icons to begin a job and enter the job setup screen. A job setup screen
provides a stepper-based flow from which you can view default settings, enter job notes for
your case, change settings, and start the job. Tap the left arrow in the job setup tab to
navigate back to the previous screen or to the Home screen.
Across the top navigation bar there are buttons to quickly access the Side Navigation menu,
the Home screen, and view the current time. The TX1 model name in the top navigation bar
links to the Home screen.
There are two tabs on the main screen: Home and Jobs. The Home tab shows the Home screen
or one of the many other screens. The Jobs tab always shows the Jobs summary screen and
the current number of total active and queued jobs.
The three buttons at the bottom of the Home screen are for Sources,Accessory drives, and
Destinations. The number in each section represents the number of attached and detected
drives (including network shares). In addition to providing the drive count, these buttons can
be tapped to display a summary list of available drives and allow access to further drive detail,
screens, and operations.
Note: The middle section of the bottom row of the Home screen (for
USBAccessory drives) is only shown when a USBAccessory drive is connected.
CHAPTER 2 Overview 15

Side Navigation Menu
The menu icon in the upper left corner of the top navigation bar displays a side navigation
panel that provides a menu of additional options and information. For additional information
on the items in this menu, see Configuring the TX1 on page23.
Jobs Tab
The Jobs tab, which is found on the right side of the tab navigation bar, is followed by a
counter. When TX1 is first powered on, the Jobs counter is at 0. Once jobs are underway, each
active or queued job will increment the counter. The Jobs tab is a convenient way to keep
track of queued jobs, active jobs, and recent work done by TX1.
The Jobs screen has three sections: Active Jobs, Queued Jobs, and Recent Jobs. After two
active jobs are running, additional job requests are placed into a queue. Queued jobs start as
soon as one of the two active jobs is complete, or when the source or destination resource the
job is waiting for becomes available. Likewise, as jobs are completed, they are moved to the
Recent section, so that a user can see what has already completed.
16 Tableau TX1 User Guide Version 2.0

A fourth section, Media Utilities, displays media utility operations and only appears when a
media utility operation is active. Media utility operations will move to the Recent section when
they are complete. Media utilities cannot be queued like forensic jobs.
Here are two examples of the Jobs tab in action:
In the first example, there are two active Duplication jobs, with one closer to completion than
the other. There is one Hash job queued, waiting for one of the active drives to complete its
duplication, and there are two recent jobs, both of which successfully completed. Since Jobs
pending includes both active and queued jobs, the Jobs tab counter reads 3.
In the second example, there are no active or queued jobs, only several recent jobs.
Job Status
After a job starts, its Job Status screen is automatically displayed. This status screen shows the
details of a given job, including a header with its status, overall data rate, time remaining, and
percent complete. The lower section of the Job Status screen shows additional job details,
including sub-step progress (for example, Duplication separate from Verification in a
Duplication/Verification job), a settings summary, and a listing of the drives involved in the
job. Tapping a drive tile open the drive details screen for that drive, providing a quick view of
all the information available for each drive. An example of an active Job Status screen is shown
below.
CHAPTER 2 Overview 17

Note: The solid orange triangle in the upper right corner of the drive tiles indicates
that the drive is currently being used as part of an active job. This is shown
regardless of the location of the drive tile and makes it easy to spot drives that are in
use. Similarly, drives that are part of a queued but not yet active job will show as an
orange border triangle with white in the middle.
Once a job has completed, the Job Status screen displays and shows the final status of that
job. Completed jobs have a link to the log file for that job on the right side of the header
section at the top of the status screen.
18 Tableau TX1 User Guide Version 2.0

Clicking the View Log link immediately displays the detailed text log for that job. You can easily
click back to the Job Status screen or close the log and return to the Home screen. The link
back to the Job Status screen works regardless of the method used to get into the log details
window. For example, if you had navigated to the log details for a given job through the side
navigation bar Logs view, there will be a link at the bottom of the log to view the Job Status
screen (View Job).
Note that the Job Status screen can also be viewed for completed jobs that are shown in the
Recent section of the Jobs tab. Simply tap on the job row from the Recent jobs section and the
final Job Status screen for that completed job is shown, including a link to the job log.
Quick Reference Guide
The TX1 ships with a Quick Reference card that illustrates the drive connections, Status LED,
power button, cable recommendations, and tips for getting started. Keep this card with the
TX1 as you familiarize yourself with its operation.
Reading the Status LEDs
On/Off indicator LED: The illuminated power switch is located in the top-left corner of the TX1
and it displays a white LED when the unit is on.
CHAPTER 2 Overview 19

DC In LED: The TP6 power supply cable has a blue LED ring near the end of the barrel
connector that indicates the TX1 power supply is receiving adequate DC input power.
Activity LED: The multi-color activity LED is located in the lower-right corner of the TX1. It is
white when the unit is booting up, blinking white when a power issue is detected, off when the
unit is idle, blue when an operation is in progress, blinking green when an operation completes
successfully, and blinking red when an operation fails.
Network Interface LED: The 10 gigabit Ethernet connector is located on the back of the TX1
and it has two LEDs. The table below provides details for interpreting the status of these
network interface LEDs.
Status
Green LED
(Indicates link status and blinks for activity)
Green/Yellow LED
(Indicates link speed)
No Link Off Off
100 Mbps Link On / Blink Off
1 Gbps Link On / Blink Yellow
10 Gbps Link On / Blink Green
Interpreting Audio Feedback
The TX1 plays one of two sounds that indicate status at the end of a job. A chime sound plays
for a successful job, and a buzzer sound plays for a failed job. You can change the volume of
the sounds or disable them from the System Settings submenu in the Side Navigation menu.
On-screen Warnings
The TX1 will provide, as necessary, on-screen warnings within various settings and operations
screens of the user interface. Yellow warnings call the user’s attention to a potential risk, but
do not impede operations. Red warnings mean either that a selected setting cannot be
accommodated, an operation has failed, or a potential exists for forensic evidence to be
missed, such as when a DCO is detected and not removed. Users are encouraged to pay
attention to and read any displayed warnings when they appear and proceed accordingly.
20 Tableau TX1 User Guide Version 2.0