QUICK LINKS
Introduction
Bridge Overview
Indicator LEDs
Configuration Switches
Recommendations for Proper Use
Using the LCD Display
INTRODUCTION
This document describes the Tableau T8 Forensic USB Bridge.
The Tableau T8 is designed to allow forensically sound images to be extracted from USB mass storage devices. That is to say, using the T8 data can be read from the USB mass storage device without fear that data on the USB device will be modified inadvertently during the acquisition process.
Tableau calls the T8 a "bridge" because it can connect to the host computer through either a USB 2.0 or a FireWire400/1394A connection. In the computer forensics field, the T8 could also be referred to as a "USB write-blocker."
NOTE: There is an important difference between the T8 and Tableau's other forensic bridge products, namely, while Tableau's IDE, SATA, and SCSI forensic bridges can be field-switched between read-only (write-block) and read-write modes of operation, the T8 is permanently configured for write-blocking operation.
T8 OVERVIEW
The image below is a picture of the T8 with captions identifying elements including connectors, switches, buttons, and the LCD display.
Each of these elements is described in detail in the following table.
| T8 Element |
Description |
| DC IN |
The DC IN connector on the T8 is compatible with the output of the Tableau TP1 power supply.
WARNING: Never connect any power supply except the Tableau TP1 to the DC IN connector. Doing so may permanently damage your Tableau T8 and will void the product warranty.
|
| ON/OFF Switch |
The ON/OFF switch controls power to the T8's internal electronics and to the USB device attached to the USB 2.0 (device) connector. |
| FireWire (host) |
FireWire400/1394A connector. Used when connecting the T8 to a host computer via FireWire/1394. When using FireWire to connect the T8 to a host computer, do not plug a cable into the USB 2.0 (host) connector. |
| USB 2.0 (host) |
USB 2.0 connector. Used when connecting the T8 to a host computer via USB 2.0. When using USB to connect the T8 to a host computer, do not plug a cable into the FireWire (host) connector.
NOTE: The Tableau Firmware Update only works when the T8 is connected to the host computer via FireWire.
|
| USB 2.0 (device) |
Plug the device to be write-blocked into the USB 2.0 (device) connector. |
| LCD Display |
The LCD display shows the current status of the T8, including whether or not a USB device has been successfully recognized by the T8. Using the T8 buttons (see below), the user may also navigate additional information screens shon on the LCD display. |
| LCD Contrast Adjustment |
The LCD contrast is already set for normal viewing when the T8 is shipped from the factory. However, you may need or want to adjust the LCD contrast to suit your preferences or work evironment. To adjust the LCD contrast, carefully insert a #0 philips head screwdriver - a small jeweler's screwdriver may be required - in the hole as shown in the above image. To make the display darker, rotate the screwdriver counter-clockwise. To make the display lighter, rotate the screwdriver clockwise. Please note: If the contrast adjustment is rotated too far clockwise or counter-clockwise, the display will become to light or dark to be readable. |
| Buttons |
The T8 has two buttons, "Menu" and "Enter." These two buttons may be used to navigate additional informational screens on the LCD display. The arrangement of information viewable on the LCD display is described later in this document. |
Though not identified in the above image, the Tableau T8 also has a "knock-out panel" located on the right edge (between the ON/OFF switch and the USB 2.0 device connector). This panel can be removed so that internal configuration switches may be accessed without opening the T8's plastic enclosure. Please note that once the knock-out panel is removed, it cannot be reinstalled.
INDICATOR LEDs
Six indicator LEDs are also visible in the above image. The following table describes each of the indicator LEDs found on the Tableau T8.
| Indicator LED
|
Description
|
| DC IN |
This LED illuminates whenever there is power at the DC IN connector. This LED will illuminate whether or not the T8 is actually turned ON. |
|
Power
|
This LED illuminates to indicate that the Tableau T8 has been turned ON using the ON/OFF switch. When this LED is illuminated, the Tableau T8 is operating and power is available at the USB 2.0 device connector. |
|
Write Block
|
The Write Block LED is illuminated to indicate the Tableau T8 is in read-only (write-blocking) mode. This LED provides a positive indication that the Tableau bridge may be used to capture a forensically sound image from a subject hard disk.
NOTE: Unlike other Tableau products, the T8 cannot be switched between read-only and read-write modes of operation. Therefore, in a properly functioning T8, the Write Block LED should always be illuminated.
NOTE: The Write Block LED will blink for five seconds whenever an attempt is made by the host operating system to write to the subject USB device. The blinking indicates that the Tableau T8 intercepted and blocked the write request. Note also, that the operating system itself may block an application's attempt to
write to the subject hard disk, and the Write Block LED will
not blink in this situation.
|
|
Device Detect
|
This LED indicates that the Tableau bridge has successfully identified a USB mass storage device connected to the T8's USB 2.0 device connector.
NOTE: The Device Detect LED on the T8 blinks to indicate that a USB mass storage device has been identified, but the device is not yet "ready". As soon as the device reports that it is ready, the Device Detect LED will glow steadily.
|
|
Host Detect
|
This LED operates differently depending on whether you are using FireWire/1394 or USB to connect the T8 to a host computer.
When using FireWire/1394, the Host Detect LED will turn
ON only after the Tableau bridge has successfully
identified a subject hard disk and after the host
computer has "logged in" to the Tableau bridge using the
FireWire/1394 SBP-2 protocol.
When using USB to connect to a host computer, the Host Detect LED will illuminate as soon as the T8 recognizes that the USB cable has been connected to a host computer, whether or not the T8 has identified a subject USB device.
|
|
Activity
|
The Activity LED indicates that the host is performing some kind of I/O to the subject USB device.
|
CONFIGURATION SWITCHES
Like other Tableau bridges, the Tableau T8 incorporates a 4-position DIP switch which can be used to set various configuration options. In the T8 these switches may be accessed by removing a small knockout panel on the right edge of the bridge's plastic enclosure.
CAUTION: Do not open the T8 case under any circumstances. Doing so will void the warranty. If you need to gain access to the configuration switches, please remove the knock-out panel and manipulate the DIP switches without opening the T8.
The following pictures show the location of the configuration switches on the T8. The location of the switches is highlighted by a red circle.
 |
| T8 Side View (right)
|
The following table summarizes the function of the configuration switches
on the Tableau T8 forensic bridge.
|
|
Operation
|
|
Switch
|
Switch OFF
|
Switch ON
|
|
1
|
This switch is RESERVED as must remain in the OFF position
for correct operation.
|
|
2
|
Only use this switch when directed by Tableau technical support. Default mode is OFF.
|
|
3
|
Only use this switch when directed by Tableau technical support. Default mode is OFF.
|
|
4
|
This switch is RESERVED as must remain in the OFF position
for correct operation.
|
IMPORTANT: The Tableau T8 will never permit writes or other modifications to the subject USB device.
RECOMMENDATIONS FOR PROPER USE
Three "recommendations for proper use" are printed on the label affixed to the bottom side of the T8:
| 1. |
Connect/disconnect USB device only when T8 power switch is OFF. |
| 2. |
Use caution when connecting FireWire/1394 and USB cables...Connecting cables backwards can permanently damage the T8 and voids the Tableau warranty. |
| 3. |
Never apply pressure to the LCD display. |
In particular, please observe recommendation #2. Tableau has observed that more than 50% of Tableau's field returns for forensic bridge products are due to a single problem, namely, that the FireWire/1394 circuity in the forensic bridge has been permanently damaged due to a mis-connected or mis-wired 1394 cable, computer, or device. Please, be careful when plugging in FireWire cables!
In addition to the recommendations listed above, please also consider the following recommendation.
| 4. |
When using the T8 with a computer running Microsoft Windows, always use the Windows "Safe Removal Applet" to tell Windows to shut down the Tableau T8 device before unplugging or turning OFF the T8. With the T8, it is easy to switch quickly between different subject USB devices. Unfortunately, the Windows driver stack often will not recognize that the USB device has changed when you switch quickly between devices unless you remember first to shut down each device using the Safe Removal Applet. |
USING THE LCD DISPLAY
The T8 Forensic USB Bridge incorporates an LCD display through which the user can view a variety of information. Some of this information is useful in the normal course of forensic work, such as the make, model, serial number, and capacity of the subject USB mass storage device. Other information is intended to assist in troubleshooting situations in which the T8 may not be recognizing USB devices as expected.
The operation of the LCD display is detailed in a separate document. Please use the following link to view the documentation for the T8's LCD display.
T8 LCD Display Documentation
| 
