QUICK LINKS
Introduction
Bridge Overview
Configuration Switches
INTRODUCTION
This document provides technical information for the Tableau T35i
combination Forensic SATA/IDE Bridge.
The T35i combines two separate forensic bridges (IDE, and SATA) into one convenient
package while providing native support for each hard disk technology. The T35i is designed to be
installed permanently in the front of a forensic workstation or tower which has an open 5.25"
half-height drive bay.
The T35i connects to the host computer through a FireWire800 (1394B) interface. Using FireWire
as the interface to the host computer allows modern operating systems to recognize that
the drives themselves are hot-swappable. This, in turn, eliminates the need to turn the host
computer ON and OFF each time a new hard disk is attached or removed; only the T35i needs to be
power cycled.
The combination of hot-swapping and the READ-ONLY forensic mode of operation make the T35i
ideally suited for use in high-volume forensic applications.
BRIDGE OVERVIEW
The picture below is a close-up front view of the T35i.
The Table below describes each of the elements visible on the front of the T35i.
|
Front Element
|
Description
|
|
Power Switch/LED
|
The Power switch controls power to the T35i as well as to the DC OUT connector
used for powering the connected hard disk.
The Power LED will be illuminated when there is power to the T35i and the
power switch is in the "ON" position.
|
|
SATA Det LED
|
The SATA Det LED (SATA Detect) illuminates when a hard disk attached to the SATA interface
connector has been properly recognized. Only one hard disk may be connected to the T35i at a time.
|
|
IDE Det LED
|
The IDE Det LED (IDE Detect) illuminates when a hard disk attached to the IDE interface
connector has been properly recognized. Only one hard disk may be connected to the T35i at a time.
|
|
Host Det LED
|
The Host Det LED (Host Detect) indicates when the connected hard disk has been
recognized by the host computer. The Host Detect LED will illuminate only
after the T35i has successfully identified a hard disk connected to the
front of the T35i and after the host computer has "logged in" to the
coresponding T35i channel using the FireWire/1394 SBP-2 protocol.
|
|
Wrt Blk LED
|
The Wrt Blk LED (Write Block) is illuminated whenever the Tableau bridge is in
READ-ONLY mode. This LED provides a positive indication that the bridge may be
used to capture a forensically sound image from a subject hard disk.
|
|
Activity LED
|
The Activity LED indicates that the host is performing some kind of I/O to the
connected hard disk.
|
|
DC OUT Connector
|
The DC Out connector may be used to provide power from the Tableau bridge
to the subject hard disk. The DC Out output is controlled by the power switch.
So, using the DC Out connector guarantees that the drive will be powered ON/OFF
simultaneously with the T35i bridge.
|
|
Disk interface Connectors (SATA and IDE)
|
The disk interface connectors attach the subject hard disk to the T35i.
Tableau recommends the following cables:
|
Interface |
|
Cable |
|
SATA |
|
TC3-8 |
|
IDE |
|
TC6-8 or TC6-2 |
|
The next image is a rear view of the T35i. Captions identify each internal T35i
connector and the location of the configuration switches.
The following table describes each of the elements shown in the above picture.
|
Internal Element
|
Description
|
|
1394B (FireWire 800)
|
The T35i must be connected to the host computer via a FireWire800/1394B
connection. This is the interface through which each of the T35i's
two I/O channels will communicate with the host computer. It is
acceptable to use FireWire400/1394A instead (with an appropriate cable
adapter), but performance will be reduced.
|
|
DIP Switch Bank
|
The T35i has one DIP switch bank with four switches.
The next section in this document, Configuration Switches,
describes the function of these switches in detail.
|
|
Power
|
Power should be provided to the T35i through the standard 4-pin
"Molex"-style power connector shown in the picture. The T35i requires
approximately 450mA @ +5VDC for its internal operation. This figure does
not include the power requirements of the hard disk connected to
the DC OUT connector on the T35i.
IMPORTANT: Tableau strongly recommends that the T35i be on a
dedicated power supply lead. Switching the T35i on/off can lead to large
current/voltage surges which can interrupt the operation of other devices
which share a power supply connection with the T35i.
|
CONFIGURATION SWITCHES
The following table summarizes the function of the four position DIP switch.
|
|
Operation
|
|
Switch
|
Switch OFF
|
Switch ON
|
|
1
|
Bridge operates in forced READ-ONLY mode and may be used to
capture forensically sound images from subject hard disks.
|
Bridge operates in READ-WRITE mode.
|
|
2
|
Bridge reports errors if host computer attempts to write
when bridge is in READ-ONLY mode.
|
Bridge does not report write errors when in READ-ONLY mode.
(The bridge discards write data without returning an error.)
|
|
3
|
Bridge reports that it is WRITE-PROTECTED to the host
computer when in READ-ONLY mode.
|
Bridge does not report that it is WRITE-PROTECTED when
in READ-ONLY mode.
|
|
4
|
This switch is RESERVED as must remain in the OFF position
for correct operation.
|
The following table summarizes the recommended Tableau bridge configuration
depending on the operating system you are using. These recommendations apply
only when using the Tableau bridge
in READ-ONLY mode to capture forensic images from subject hard drives (i.e.,
when the Write Block LED is illuminated).
|
O/S
|
SW2-2
|
SW2-3
|
Comments
|
|
Windows XP
|
OFF
|
OFF
|
In most situations, Windows XP handles READ-ONLY bridges correctly
and will work optimally when leaving switches 2 and 3 in the OFF
(default) state.
However, Tableau has seen cases where Windows XP will not
allow a user to access a READ-ONLY partition. If you encounter
a situation in which Windows XP reports that a volume is "write
protected" and will not allow you to access the partition, then
try the switch setting recommended for Windows 2000, below.
|
|
Windows 2000
|
ON
|
ON
|
Windows 2000 does not mount NTFS volumes correctly when the bridge
declares that it is READ-ONLY. These settings make Windows 2000
believe the bridge is in READ-WRITE mode (even though it is not),
and Windows 2000 will successfully mount NTFS volumes.
|
|
Windows ME/98se
|
ON
|
OFF
|
Windows ME/98se may not recognize that a bridge is READ-ONLY and
may attempt to write to the bridge anyway. If this happens,
Windows ME/98se will generate a "blue screen" error. The
recommended settings to the left eliminate the "blue screen" error.
NOTE: Some forensic users prefer to see the Windows
"blue screen" error if a write is attempted. Users with this
preferences should use the recommended settings for Windows XP
instead.
|
|
Other
|
OFF
|
OFF
|
Most other modern operating systems handle READ-ONLY forensic
bridges correctly, so the default OFF settings are best for users
of these operating systems.
|
IMPORTANT: As long as the Write Block LED is illuminated, the Tableau
bridge will never permit writes or other modifications to the subject hard disk.
Switches 2 and 3 only affect the way the bridge appears to behave from the
perspective of the host computer.
NOTE: Switches 2 and 3 are ignored when the Tableau bridge is in
READ-WRITE mode (i.e., when the Write Block LED is off).
| 
