OpenText™ Tableau Forensic TD4 Duplicator

Simplify smaller-scale disk triage, acquisition and media management workloads

According to IDC, 95 percent of investigations have a digital component.1As a result, it is simply not feasible to confiscate a suspect’s device and take it back to the lab for analysis.

Imagine the inefficiency associated with labs stacked floor to ceiling with suspect laptops and computers—devices that investigators would never get the opportunity to analyze.

Digital investigators instead need to forensically acquire the information contained on a suspect device as a forensic image or clone. This must be an exact, bit-by-bit copy that

can be used for evidence analysis. Imaging the device, instead of taking physical custody saves time, money, real estate

and resources.

The OpenText™ Tableau Forensic TD4 Duplicator is

next-generation technology designed as a budget-friendly, easy-to-use solution for standalone forensic acquisitions of common physical media (PCIe, USB, SATA and SAS). TD4 delivers the ideal combination of features and performance to handle smaller-scale triage, acquisition and media

management workloads.

Ease of use

The TD4 retains settings across power cycles, allowing users to start a forensic acquisition with a single click. Administrative controls can also be set to assist more junior investigators, including limiting functionality, ensuring evidence security or guiding a user to a predetermined job configuration.

Maximizing use of resources

Organizations on tight budgets often re-use destination media between cases to save costs. As a suspect source drive is imaged, examiners must ensure the destination media has been wiped clean of any previous case data to prevent cross-case contamination and ensure forensic integrity. Often a separate product is needed to wipe drives, but the Tableau Forensic TD4 Duplicator provides a ‘Reconfigure’ option for users to decide what combinations of actions (wipe, format, encrypt) they want to apply to connected destination media, saving the need for another tool. Both clear and purge disk wipe capabilities are available adhering to NIST standards. Additional wipe configurations are also available to ensure the destination media is ready for reuse. The TD4 can then format a filesystem back on the drive and encrypt it, if desired, making it ready for use in the next investigation. This ‘Reconfigure’ option improves the efficiency of the destination media management process by conducting these operations consecutively rather than as standalone operations.

Corporate applications

In addition to acquisitions from corporate devices, TD4 includes an “IT mode,” which allows the Duplicator to be repurposed for on-site imaging and delivery (for new employee laptops, for example) without the extra steps it normally performs for forensic integrity or chain of custody.

Hot swapping—an industry first

Hot swapping drives is not optimized with the standard PCIe bus. However,

the Tableau Forensic TD4 Duplicator is the first product in the industry to enable PCIe hot swap of both source and destination drives. Users can safely eject and swap PCIe drives without the need to power-cycle, saving time and frustration during imaging.

PCIe, SATA and IDE ready

The TD4 is compatible with the Tableau Forensic line of PCIe, SATA and IDE adapters to provide compatibility with a wide variety of source media interfaces, ensuring seamless imaging operations.

The digital forensic tools of choice for government, law enforcement and corporations

Tableau Forensic solutions facilitate digital forensic investigations with imaging, duplication and forensic write-blocking capabilities. They provide the ideal combination of features/performance, affordability, ease of use and portability for both field and lab-based investigations.

Law enforcement, government agencies and corporations around the world have trusted Tableau Forensic as their imaging technology of choice for more than

20 years. As the pioneer in digital forensic investigations, Tableau Forensic

and OpenText™ EnCase™ digital forensic solutions provide the information advantage needed to help make the world a safer, more secure place by finding the truth in data.