Tableau TD3 Forensic Imaging System: Raising the Bar Since 2012

Robert Bond

When Guidance Software originally released the Tableau TD3 forensic imaging system back in 2012, it was revolutionary. Forensic investigators had asked for and eagerly awaited innovations like the color touchscreen user interface, modular architecture, network imaging, and remote triage capabilities. The TD3 also supported write-blocked imaging of SATA, IDE, SAS, FireWire, USB 3.0, and iSCSI (network) storage devices. In 2013, Forensic 4Cast voters named it the Forensic Hardware Tool of the Year. Since its launch, the TD3 development team has relentlessly focused on adding new features, capabilities and options that help investigators get more work done faster, with more options. So if the last time you looked at TD3 was back in 2012, it may be time to take another look.

Add New Features Easily with the Tableau Firmware Update (TFU)

Adding new features to TD3 using the Tableau Firmware Update (TFU) utility is fast and easy. Even better: it’s free. Investigators receive all Tableau feature enhancements through firmware updates at no cost.

TD3 Speaks Your Language, Supports exFAT, and Offers 1:2 “Twinning”

Since launch we’ve added support for exFAT evidence drives which provides a cross-platform disk format, supported by Windows, MacOS and Linux. ExFAT also provides support for drives greater than 2TB. At the request of our Japanese customers, we added disk-to-disk ‘clipping’ support, which sets a DCO on the destination drive and allows easy imaging of game box drives, by allowing the evidence drive to exactly match the sector count of the suspect system’s drive. Support for imaging to or from iSCSI network shares enhanced TD3’s network forensics capabilities. Using a workstation connected via network to TD3, you can preview as well as collect files and folders of suspect drives. We also added in support for new EnCase v7 .ex01 output file format.

Earlier in 2014, we added support for 1:2 duplication (“twinning”) using two TDS2 SATA drive enclosures. We’ve also added the ability to restore a DCO on a source (suspect) drive, after the TD3 completes its imaging process.

For our international customers, probably the best new trick we’ve taught TD3 is the ability to speak in their language. As of Q2 2014, TD3’s UI supports Spanish, Portuguese, German, Russian and simplified Chinese languages. Since launch, TD3 has been continuously improved with new drive information, S.M.A.R.T. drive data, new media support, and many, many other new features too numerous to mention. (We even added sound effects, so you can tell when TD3 has finished an operation, from across the room.)

New Expansion Modules and Storage Options Make TD3 an Even Better Choice

Earlier this year, two new expansion modules were released for TD3. The TDPX8-RW USB 3.0 Output Module gives the user a new way to output TD3 evidence files: SuperSpeed USB 3.0. This new module is now included with every new TD3 kit at no additional charge. When collecting highly secure evidence, the TDPX8-RW lets you use keypad-authenticated, AES-encrypted USB 3.0 storage systems with TD3. TDPX8-RW is an option for using the new TDS2 drive enclosure, also now bundled with TD3. The locking handle on TDS2 enables easy drive replacement while also securing the 3.5” SATA hard drive within the enclosure. No need for cables, as the SATA power and signal connections are made directly between the TD3 and TDS2, as part of TD3’s modular architecture.

Also introduced this year for TD3 is the new TDPXE Dual-port Gigabit Ethernet expansion module. TDPXE offers the flexibility and increased performance afforded by two additional network connections. TDPXE also supports the use of “jumbo frames,” potentially doubling the network performance of TD3.

Operate TD3 Remotely with New Web Interface

Showcased at CEIC 2014, the new TD3 web UI lets you connect to, manage, and operate a TD3 remotely. Just connect your browser to a networked TD3 and go! Scheduled for public release in August 2014, the new WebUI will allow remote operation and management of one or many TD3s deployed at remote locations, from a headquarters lab located anywhere in the world.

Want to know more about TD3, and what it can do for your digital investigations? Take a look at

No comments :

Post a Comment