Does the TD1 write-protect the source drive?

Yes, as the TD1 is a forensic duplicator, write-protection is a native function of the TD1. The source drive (connected to the left side) is always write-protected, therefore the TD1 will never allow writes to the source drive.

How fast is TD1 at duplicating hard drives?

TD1's drive operation performance (duplicating, hashing, wiping, etc.) will of course be limited by the slowest drive being used.

If you are using fast drives and have high quality cables (such as the Tableau cables supplied with the TD1 kit) you can achieve rates up to 6GB/min.

Will duplication performance decrease if I use hashing on the fly with TD1?

Due to the high-performance architecture of TD1, on the fly hashing (for both SHA-1 & MD5) is always enabled. TD1 was designed to support simultaneous SHA-1 and MD5 hashing while duplicating drives without compromising drive performance.

How should I configure the drive select jumper on an IDE hard drive to work properly with the TD1?

An IDE hard drive needs to be configured as Master or Single (depending on the drive manufacturer) to work properly with the TD1. Refer to the label on the drive or the drive manufacturer's website for specific jumper instructions.

What hard-sided cases fit the foam insert included with the TD1 kit?

As shipped by Tableau, the TD1 kit includes a foam insert which holds and organizes the TD1 and its accessories. This foam insert can be removed from the cardboard box provided by Tableau and reinstalled in any of several industry-standard hard-sided cases, including:

• Pelican Model 1450
• Explorer Model 30/3818

The TD1 is not recognizing my USB device?

The USB ports on the TD1 are for use with USB thumb drives (for saving logs), USB printers (for printing logs), and for USB keyboards (for faster data entry into the TD1).

The USB interface in the TD1 is technically similar to the USB interfaces found in Tableau Forensic Bridges with write-blocked USB ports - Tableau models T8/T3458is/T34589is. if the TD1 is failing to recognize a specific USB device, please refer to the FAQ section on USB Write-Blocking. You may find suggestions in that section which help you to resolve USB compatibility issues with the TD1.

What kinds of USB devices do Tableau USB write blockers support?

The T8/T3458is/T34589is Forensic Bridges are currently designed to work with USB Mass Storage Class devices. This includes most USB "thumb drives," many USB digital cameras, Apple iPods with USB interfaces, hard disks in external USB enclosures, etc.

From a technical standpoint, the Tableau USB write blockers support USB devices which conform to USB Class 8 (Mass Storage), Subclass 2 (SFF8020I), SubClass 5 (SFF8070I), or Subclass 6 (SCSI). Additionally, the Tableau USB write blockers require that the USB device implements Protocol 50h (Bulk Only).

NOTE: The Tableau T8 originally supported only Subclass 6 (SCSI). Support for Subclasses 2 (SFF8020I) and 5 (SFF8070I) were added as of Tableau Firmware Update v3.30. This firmware update corresponds to T8 firmware date codes of Oct 19 2005 and later.

Can Tableau USB write blockers work with compound USB devices?

A compound USB device is a USB device which incorporates multiple functions in a single unit. Tableau USB write blockers may be able to work with such devices, but this is not guaranteed. The order in which the compound USB device's functions are enumerated determines whether or not the device will work in conjunction with the Tableau write blockers. Additionally, as noted in the previous FAQ, Tableau USB write blockers work with devices conforming to the USB Mass Storage Class specification.

Do Tableau USB write blockers work with USB memory card readers?

Tableau USB write blockers work with some USB memory card readers. Whether or not the Tableau USB write blocker works with a specific USB memory card reader depends on the internal design of the memory card reader.

For example, USB memory card readers often support more than one type of memory card/slot. If the USB memory card reader reveals itself on the USB interface as a single USB device (or "function" in USB parlance), then the Tableau write blocker will generally work well with the USB memory card reader. However, if the USB memory card reader reveals each memory card/slot as a different USB device--that is, the USB memory card reader presents itself as a compound device--then the Tableau write blocker may not work as expected. The Tableau write blocker will "lock onto" the first mass storage device it finds, ignoring the others. If a memory card is inserted into a slot in the reader which isn't the "first" device, then the T8 won't find the memory card.

Unfortunately, it is very difficult to know without testing how a given USB memory card reader is implemented. USB memory card readers which have only a single memory card/slot will generally work with Tableau USB write blockers.

NOTE: Tableau sells a 15-in-1 memory card reader, model TDA8-M, which is fully compatible with Tableau USB write blockers.

The Tableau USB write blocker is not seeing my USB device. What can I do?

Under certain circumstances a Tableau USB write blocker will fail to recognize a USB device if it is attached to the write blocker before the write blocker has been turned ON. As a workaround, try turning ON the write blocker first, then attaching the problematic USB device. This may allow the write blocker to recognize the device properly.

The Tableau USB write blocker is not seeing my USB external storage device. What can I do?

There are two important details that will help you acquire external storage devices that require larger amounts of power over the USB bus.

• First verify that you are using the most current firmware release for your Tableau USB write blocker. Many large bus-powered external storage devices were unsupported until Tabelau Firmware Update v6.20 (T8 firmware timestamp: Nov 06 2008 14:40:57).
• Most bus-powered external storage disks will require an auxiliary power supply. There are two ways this can be accomplished. The safest method is to power the external device through a powered USB hub. Unfortunately the way a hub is implemented varies by manufacturer and not all powered hubs will work. A more reliable option (potentially risky!) is to use a USB power "Y" cable, where power is borrowed from the host. Forensic examiners must be particularly cautious with this configuration since it would be easy for a careless examiner to mount a drive to the host computer in "RW" mode.

When mounting some FireWire/USB devices through a Tableau write blocker the Activity LED remains solid for a long period of time. What's wrong?

Some drives have a filesystem structure that Windows wants to interrogate extensively upon mounting, which results in a potentially large number of small I/O requests. When mounting these drives through a Tableau USB or FireWire write blocker the Activity LED remains on constantly during this scan. This process may take 10-60 seconds, but once the scan is complete the drive may be imaged or browsed normally.

Will Tableau SCSI bridges work with Ultra320 SCSI hard disks?

Yes, Tableau SCSI bridges should be compatible with hard disks including Ultra320 hard disks.

The SCSI standard requires devices to be backwards-compatible with slower transfer modes, for example, so that new hard disks can be compatible with slower host adapters and vice-versa. Tableau SCSI bridges support SCSI transfer modes up to Wide Ultra 2 SCSI--also known as Wide FAST-40--for a maximum transfer rate of 80MB/sec. The Tableau SCSI bridges will "negotiate" with the SCSI hard disk to determine a mutually acceptable SCSI transfer mode.

Will Tableau SCSI bridges work with HVD SCSI?

No, Tableau SCSI bridges do not directly support the older SCSI HVD (High Voltage Differential) standard. However, some companies manufacture HVD-LVD converters which can be used to convert the HVD interface on an older hard disk to the LVD standard supported by Tableau products.

What does it mean when the SCSI Detect light on the Tableau SCSI bridge is blinking?

After the T4 SCSI bridge is turned ON, it begins scanning the SCSI bus searching for a device. If the SCSI device is ready for operation, the T4 turns ON the SCSI Detect light. If the SCSI device is not ready, the T4 flashes the SCSI Detect LED until the SCSI device reports that it is ready for operation. If the SCSI Detect LED never stops flashing that most likely means the SCSI device is malfunctioning.

Do I need to jumper a SCSI device for a specific SCSI ID when I'm using a Tableau SCSI bridge?

Tableau SCSI bridges automatically search SCSI addresses 0..6 and 8..15 for an attached SCSI device. The Tableau SCSI bridge itself uses the fixed SCSI ID 7, which is "standard" for host adapters. So, you only need to change a device's SCSI ID if it also happens to be set for SCSI ID 7, as that would conflict with the Tableau bridge's own SCSI ID.

Can I attach more than one SCSI device to a Tableau SCSI bridge at the same time?

No. Tableau SCSI bridges are only intended to work with a single SCSI device at a time.

What is the meaning of the two LEDs (one green and one yellow) on the side of the T4 SCSI bridge?

The green and yellow LEDs on the side of the T4 next to the HD68 SCSI connector indicate whether an LVD (Low Voltage Differential) or SE (Single-Ended) SCSI device is plugged into the T4. The green LED indicates LVD and the yellow LED indicates SE.

NOTE: Other Tableau SCSI-capable bridges (e.g., Tableau models T345/T3458is/T34589is) do not have externally visible LEDs to indicate the type of SCSI device detected by the bridge.

Do Tableau SCSI bridges terminate the SCSI bus?

Yes, Tableau SCSI bridges terminate the SCSI bus. The SCSI specification requires termination at each end of the bus. So, for proper operation, the SCSI device should also be terminated. Most modern SCSI devices have jumper options to enable termination.

Why don't the T3 SATA bridge and T5 IDE bridge have ventilation slots like the T4 SCSI bridge?

The T4 SCSI bridge consumes approximately 50% more power than the T3/T3u SATA and T5 IDE bridges. When Tableau's engineers designed the T4 they decided that the extra heat dissipated by the T4 warranted the addition of ventilation slots.

While the T3/T3u and T5 do not generate enough heat to require ventilation, Tableau has decided to standardize future case production and all products will incorporate ventilation slots beginning in late 2004.

What is eSATA and how is it different that SATA?

eSATA (external Serial ATA) is an extension to the SATA (Serial ATA) standard, which enables SATA drives to be attached to a host computer externally. Although eSATA uses identical protocol signaling as SATA, the physical connector is different. The most obvious difference is that the eSATA connector is straight instead of the "L" shaped SATA connector. eSATA cables also contain an extra layer of shielding and the connectors have metal contact points to reduce EMI. The plug is also deeper to help protect against ESD (Electrostatic Discharge).

What type of cable should I use to connect my Tableau eSATA Forensic Bridge to my host's eSATA port?

eSATA cables can be up to two meters (approximately six feet) in length. Tableau offers two lengths of eSATA cables for purchase, the TC9-1M (one meter length) and TC9-2M (two meter length). The TC9-1M cable is included in the TK35es Forensic eSATA Bridge Kit.

Be careful when using eSATA cables other than Tableau's. During our eSATA testing, we noticed some manufacturer's eSATA cables that didn't fully conform to the eSATA physical spec and therefore didn't always work properly.

Is eSATA a hot-pluggable connection type?

Although eSATA is designed to be a hot-pluggable connection type, this feature requires proper support at the host, device, and controller level. Unfortunately, not all eSATA controller manufacturers properly support hot-plugging yet.

It is recommended that before disconnecting an eSATA device from your host, you safely eject the device, just as with unmounting a FireWire or USB device. If the eSATA controller does not offer this capability, it may be necessary to power down your machine before an eSATA device can be safely removed.

As with all forensic tools in your arsenal, please test your equipment before attempting to perform an acquisition of an evidence drive.

Is eSATA faster than FireWire 800?

Yes, eSATA is faster than FireWire 800. With fast enough source and destination SATA hard drives, and an eSATA controller card, using an eSATA connection will yield faster transfer rates than FireWire 800. The maximum *theoretical* transfer rate of an eSATA 150 connection is 1.5Gb/s (or 150MB/s), and an eSATA 300 connection is 3.0Gb/s (or 300MB/s). Whereas FireWire 800 has a maximum *theoretical* transfer rate of 800Mb/s (or 100MB/s).

Keep in mind that these transfer rates are *theoretical* and not what you will actually achieve.

Do Tableau bridges support HPA/DCO?

Yes, with Tableau firmware released in October of 2005, Tableau IDE and SATA bridges can detect and override both HPA (Host Protected Area) and DCO (Device Configuration Overlay) regions on a hard disk.

HPA and DCO refer to specific mechanisms that can be used in IDE and SATA hard disks to "hide" regions at the "end" of a hard disk. Commands related to HPA and DCO are defined in the ATA specifications for hard disks, and these commands are often used by computer manufactures to hide, and thus protect, recovery partitions located at the end (or top) of the hard disk.

In theory, HPA and/or DCO commands could be used to hide user data as well. In practice, Tableau believes this kind of data hiding is unlikely to be seen in the field.

To upgrade your Tableau IDE or SATA bridges with support for HPA/ DCO, please download the Tableau Firmware Update.

How do Tableau bridges handle HPA and DCO?

Upon detecting an IDE or SATA hard disk, Tableau bridges with HPA/DCO support (see above) will attempt to detect if the hard disk supports HPA or DCO and if HPA or DCO is being used to protect a region at the end of the hard disk.

If HPA is being used to protect a region at the end of the hard disk, the Tableau bridge will automatically use "volatile" HPA commands to override the HPA setting, immediately making the HPA region visible to the host computer so normal imaging tools can access the data in the HPA region.

If DCO is being used to protect a region at the end of the hard disk, the Tableau bridge will not automatically override DCO. To do so, the Tableau bridge would need to send a permanent (i.e., non-volatile) command to the hard disk, and this would permanently alter the hard disk's DCO settings. Instead, Tableau plans to release utilities which can be used in conjunction with Tableau bridges in order to override the DCO settings at the explicit direction of the user.

Will Tableau's HPA/DCO support alter the hard disk permanently?

The commands needed to override HPA can be used in a "volatile" mode, so the changes are temporary and the hard disk will be returned to its original state after it is power-cycled.

The commands needed to override DCO are permanent, so they will be retained even after the hard disk is power-cycled. For this reason, a Tableau forensic bridge will never send DCO commands to a hard disk except under the explicit control of the user.

What is the purpose of the jumper located on the top of my Tableau TDA5-18 1.8" IDE adapter?

The jumper labeled JP4 on the TDA5-18 adapter is for forcing the IDE drive mode. Although seldom used by 1.8" drives, this jumper allows the user to set the drive mode using the following pin settings:

• Master: None
• Slave: 1-2 or 3-4
• CSEL: 2-4

How do I connect a 1.8" ZIF hard drive to my Tableau TDA5-ZIF IDE adapter?

ZIF drive cables and connectors are very fragile, so take extra care when working with ZIF components.

Currently there are four known manufacturers of ZIF drives: Hitachi, Samsung, Seagate, and Toshiba. There are multiple variations of which cable to use, and which way to position the drive while connecting to the ZIF adapter. Follow the steps below to determine how to connect your particular ZIF drive.

To image a Hitachi drive, connect the Tableau TC20-3-3 ZIF cable to the adapter label face-up. Then connect the cable to the Hitachi drive, positioning the drive label face-up.

To image a Samsung 1.8" drive, connect the Tableau TC20-3-2 ZIF cable to the adapter label face-up. Then connect the cable to the Samsung 1.8" drive, positioning the drive label face-up.

To image a Samsung SSD drive, connect the Tableau TC20-3-2 ZIF cable to the adapter label face-up. Then connect the cable to the Samsung SSD drive, positioning the drive label face-down.

To image a Seagate Lyrion drive, connect the Tableau TC20-3-2 ZIF cable to the adapter label face-up. Then connect the cable to the Seagate drive, positioning the drive label face-up.

To image a Toshiba drive, connect the Tableau TC20-3-2 ZIF cable to the adapter label face-up. Then connect the cable to the Toshiba drive, positioning the drive label face-down.

Are Tableau products compatible with every device ever made?

Tableau strives for 100% device compatibility. However, there are limited situations in which Tableau cannot make its products compatible with certain models of devices. Tableau maintains a list of known/documented incompatibilities here.

My SCSI device is not recognized by my Tableau T3458is (or T34589is).

Certain SCSI drives draw too much current during spin-up to work correctly when powered through the Molex power connector on the front of a Tableau T3458is or T34589is.

Please refer to the list of incompatible devices for more information and for suggested workarounds.

I'm trying to acquire a Super Talent 8GB SATA flash drive with a Tableau forensic bridge, and I'm getting really slow transfer rates. What's wrong?

The Super Talent 8GB 2.5" SATA Solid State Drive (model #FSD8GC25M) has a low-level communication incompatibility with the SATA chipset used in some older revisions of Tableau bridges. The symptom is extremely slow data transfers. This incompatibility will occur with all versions of the Tableau bridge models T3 and T3u. This will also occur with bridge models T15 and T345, but only with versions manufactured prior to July 1, 2006.

All other Tableau SATA bridge models should work properly with this drive; e.g., T35i, T35e, T35es.

Why is it necessary to have firmware updates?

Firmware updates give Tableau the ability to fix bugs and add features to Tableau forensic bridges in the field.

Forensic bridges are complicated products, and sometimes--as much as we try to avoid it--there will be bugs that make it into the field. Tableau is committed to providing the best support in the industry for its products and the Tableau Firmware Update is proof of that commitment.

And, the Tableau Firmware Update is not just for bug fixes. The Tableau Firmware Update is also used to deliver firmware with enhanced features to Tableau bridges already in the field. So, it doesn't matter if you buy your Tableau bridge today or later. You will always be able to update your Tableau bridge with the latest firmware and features available for your bridge.

How do I know which firmware update to use for my Tableau bridge?

There is only one Tableau Firmware Update program. The Tableau Firmware Update contains firmware images for each different type of Tableau forensic bridge. When you run the Tableau Firmware Update, it detects the type of Tableau bridge connected to the computer and automatically selects the appropriate firmware for that bridge.

Can I use the Tableau Firmware Update to update more than one Tableau bridge at a time?

Yes, the Tableau Firmware Update allows multiple Tableau devices to be connected to the computer at the same time.

The Tableau Firmware Update shows the firmware timestamp for each Tableau product connected to the computer. The Tableau Firwmare Update also indicates whether it has newer firmware, the same firmware, or even older firmware than the firmware which is already installed in each product.

Will the Tableau Firmware Update work with USB?

No, at the present time the Tableau Firmware Update only works when you connect the Tableau bridge to the computer using FireWire.

Will 3rd party forensic imaging applications recognize Tableau forensic bridges?

Yes, Tableau actively works with 3rd party software vendors to facilitate recognition of Tableau forensic bridges in those vendors' forensic imaging applications. Tableau recommends end users contact their preferred forensic software vendors to determine which software releases include Tableau support.

Tableau forensic bridges must have firmware dates of April 2005, or later to enable full-featured detection by 3rd party software applications.

Why are there switches on Tableau bridges?

The switches provide two main functions: 1) Thanks to the switches, Tableau bridges can be field-switched between read-only and read-write operation if so desired by the user, and 2) The switches allow end users to set the bridge's configuration for optimal use with their equipment.

Can't you ship forensic bridges that work in all situations without configuration switches?

If it were possible, Tableau would certainly ship bridges that worked optimally in all situations without the need for user configuration switches. However, each Microsoft OS prior to Windows XP has its own peculiar problems in working with forensic bridges; and designing a bridge to the "lowest common denominator" of the Windows OS's itself leads to some undesirable compromises.

For example, one of the ways to make older Windows operating systems work "correctly" with forensic read-only bridges is to make the OS "think" that the bridge/hard disk is really read-write. In this mode, the bridge simply "throws away" any writes sent by the computer to the hard disk. But this can lead to problems, as Windows maintains an in-memory cache of what it "thinks" is on the hard disk. When a bridge throws away write data, but makes the computer think the write succeeded, Windows gets out of sync with what's really on the disk; this can lead to errors in capturing forensically sound images from a subject drive.

When necessary, i.e., when using an older Windows OS, the Tableau bridges can be configured to trick Windows as just described. However, if you are using a version of Windows like Windows XP--which handles read-only bridges correctly--you are far better off if the bridge tells Windows that it is read-only. In this way, you can guarantee that Windows XP is in sync with the data that is really on the disk, and you can guarantee the forensic validity of images captured from the subject hard disk.

Why do Tableau some bridges have two different input power connectors?

When Tableau designed its family of forensic bridges it set out to create the most versatile forensic bridges on the market. In some situations it is more convenient to draw power for the bridge directly from the "Molex" power connector, i.e., the cable/connector from the power supply that was originally supplying power to the subject hard disk. In other situations it is more convenient to use an external AC/DC power adapter.

Tableau model T3/T3u/T4/T5/T35e forensic bridges support both modes of operation. The "DC In A" connector accepts power from the Tableau TP1 power supply, an external AC/DC adapter. The "DC In B" connector accepts power from the traditional Molex power connector. In either case, Tableau bridges can supply power to the subject hard disk by way of the "DC Out" connector on the Tableau bridge.

The power switch at the top of the Tableau bridges selects which DC In source is in use at any one time, and also serves as a master ON/OFF switch for both the Tableau bridge and the hard disk connected to the Tableau bridge's DC Out connection.

Note: Later Tableau bridges (i.e., T8/T9/T35es) have only the "DIN" style power input for use with a Tableau AC/DC power adapter. In these later products the power switch has only "ON" and "OFF" positions.

Why is there a black cap covering the DC IN B connector on my Tableau forensic bridge?

Most customers use the TP1 power supply with their Tableau forensic bridges. Recognizing this, Tableau designed the "TM1" cap, a plastic cover for the (often) unused DC IN B power connector. The TM1 cap protects the connector while preventing the user from accidentally touching the exposed pins on the DC IN B connector.

Why do Tableau bridges have an LED marked "Write Block"?

Tableau bridges can be switched between read-only and read-write operation at the user's discretion. The "Write Block" LED provides the user with a positive indication that the bridge is configured for read-only (write-blocking) operation when the bridge is being used to capture a forensically sound image from a subject hard disk.

Which is faster, FireWire/1394 or USB 2.0?

FireWire (IEEE 1394) is generally faster than USB 2.0 when using Tableau forensic bridges. FireWire400 (1394A) can be 30% to 50% faster than USB 2.0 on a given system and FireWire800 (1394B) is generally faster still, all other things being equal.

I see products from other companies that look identical to Tableau's products. Are they the same?

Tableau sells its forensic bridges under the Tableau brand and through certain private-labeling arrangements. Private-label products manufactured by Tableau have the "Powered By Tableau" mark. Tableau is the original equipment manufacturer; Tableau designs and manufacturers all Tableau forensic bridges, whether sold under the Tableau brand or as privately labeled products.

How should I configure the drive select jumper on an IDE drive to work properly with a Tableau IDE bridge?

An IDE hard drive needs to be configured as Master or Single (depending on the drive manufacturer) to work properly with Tableau IDE bridges. Refer to the label on the drive or the drive manufacturer's website for specific jumper instructions.

I see documentation for "internal switches" in the Tableau forensic bridges, but I don't know where these switches are on my T3 SATA bridge. Where are they?

To locate the internal switches on the original T3 SATA bridge you will need to open the T3's plastic enclosure. Remove the four screws on the underside of the case and open the case. The internal switches will be visible once you open the case.

DO NOT modify the settings of other jumpers on the T3 SATA bridge. As soon as you have made the desired changes to the internal switches, re-close the T3's plastic enclosure before using the T3.

It is NOT necessary to open the plastic case to reach the switches on the T3u SATA, T4 SCSI, and T5 IDE forensic bridges. On these products the switches may be accessed from the outside by removing the plastic knock-out panel on the bottom edge of the bridge.

The T3 SATA bridge doesn't support USB and doesn't have a knock-out panel to access the internal switches. Why is the T3 different from the T4 and T5?

The T3 SATA bridge was the first forensic bridge designed by Tableau. Early customers gave Tableau valuable feedback regarding the T3 and Tableau incorporated that feedback in later designs, including the T3u SATA bridge, T4 SCSI bridge, and the T5 IDE bridge.

Is Tableau planning to introduce an upgraded version of the T3 SATA bridge which supports USB and has a knock-out panel to access the internal switches?

Yes. Tableau introduced the T3u SATA bridge. The T3u is an upgraded version of the original T3 SATA bridge. The T3u adds support for USB 2.0 and adds an external knock-out panel to access the configuration switches.

How does the T15 compare to the T3u?

The T15 FireWire800 SATA bridge is an ultra-compact forensic bridge for use with SATA hard disks. To make the T15 as small as possible, Tableau removed several features found in the T3u. Namely, the T15 lacks a USB host interface, power switch, dual power supply options, host detect, and drive detect LEDs.

Even though the T15 has fewer features that the T3u SATA bridge, the T15 achieves imaging times comparable to the T3u and retains key T3u features such as the write block, activity, and power LEDs and configuration switches. Moreover, the T15 connects directly to the back of the SATA hard disk, eliminating the need for a SATA signal cable. And, if the SATA hard disk has a SATA-style 15-pin power connector, the T15 powers the hard disk directly, further eliminating the need for a power jumper cable.

Can I use the "legacy" power connector on a SATA hard disk when using the T15?

If the SATA hard disk has both a SATA-style 15-pin power connector and an older 4-pin "Molex-style" legacy power connector, you must not apply power to the 4-pin "Molex-style" power connector when using the T15. The T15 provides power to the hard disk through the SATA-style 15-pin power connector. Applying power to both connectors at the same time may seriously damage the SATA hard disk, the T15, or both.

If the SATA hard disk has only the older 4-pin "Molex-style" power connector, then it is not possible for the T15 to provide power directly to the hard disk and you must power the hard disk through the 4-pin "Molex-style" connector.

Why is my T5 or T14 yellow?

The Tableau T5 and T14 IDE bridges, like all Tableau forensic bridges, can be configured for read-only or read-write operation. Some customers require T5 and T14 units pre-configured for read-write operation. To make these units stand out, so they aren't accidentally confused with write-blocking Tableau forensic bridges, Tableau manufactures these units in yellow cases instead of the standard black cases used on write-blocking units.

How does the T14 compare to the T5?

The T14 FireWire800 IDE bridge is an ultra-compact forensic bridge for use with IDE hard disks. To make the T14 as small as possible, Tableau removed several features found in the T5. Namely, the T14 lacks a USB host interface, power switch, dual power supply options, host detect, and drive detect LEDs.

Even though the T14 has fewer features than the T5 IDE bridge, the T14 achieves imaging times comparable to the T5 and retains key T5 features such as the write block, activity, and power LEDs and configuration switches. Moreover, the T14 connects directly to the back of the IDE hard disk, eliminating the need for an IDE signal cable.

What are the specs for the TP1 power supply?

The Tableau TP1 power supply is an AC/DC adapter. It accepts an input voltage from 100-240VAC and provides regulated outputs at +5VDC and +12VDC.

How much power is available for the hard disk when using the TP1?

When you are using the Tableau TP1 to power a Tableau bridge and a hard disk connected to the bridge's DC OUT, you naturally want to know how much power is available for the hard disk.

As a good rule of thumb, when using the TP1 and a Tableau forensic bridge, the hard disk can draw from 1.0-1.5A @ +5VDC and up to 2.0A @ +12VDC.

You can generally find a hard disk's current requirements printed on a label on the outside of the hard disk. But be careful! During spin-up, some hard disks have been observed to draw much more than their rated current. So, if the hard disk's stated requirements are close to the recommended TP1 limits provided above you may find the TP1 won't be able to provide enough current for the hard disk to spin up.

Can the TP1 power any hard disk?

No, the TP1 may not be able to provide enough power for some hard disks. In particular, Tableau has found that some older, 5.25" full height SCSI hard disks draw too much power during spin-up and cannot be powered by the TP1. In these cases, Tableau recommends you power the hard disk from its existing power supply and use the TP1 to power the Tableau bridge separately.

Does a Tableau bridge provide FireWire/1394 Bus Power?

Yes and no.

The Tableau T3/T3u/T4/T5/T10 bridges feed FireWire (1394) bus power from +12VDC. Tableau bridges incorporate a 1-1.5A current limit and a protection diode to ensure that current flows only from the Tableau bridge's +12VDC supply to the FireWire bus power signal.

The Tableau T14 and T15 bridges do not provide FireWire (1394) bus power.

All Tableau bridges with more than one FireWire (1394) connector (that includes the T3/T3u/T4/T5/T10/T14/T15) repeat FireWire bus power. That is, if FireWire bus power is present on one of the Tableau bridge's FireWire800 or FireWire400 ports, that power will be repeated to the other FireWire800 and FireWire400 ports on the Tableau bridge.

Can Tableau bridges be powered by FireWire or USB bus power?

No, Tableau bridges cannot be powered by FireWire/1394 bus power or by power from a USB cable.

When I attach a Tableau forensic bridge to my computer via FireWire, I hear the fans running in my computer even though the computer is turned off. What is happening?

There is a power wire in standard 6- and 9-pin FireWire cables, and many FireWire devices (including FireWire host adapters and Tableau forensic bridges) are designed to provide power to this wire. In each device which provides power to a FireWire cable there is circuity to prevent power from flowing from the cable back into the device. This circuity usually includes an electrical component called a diode. Tableau has found that some FireWire host adapters are mis-manufactured, and the diode in these FireWire host adapters is backwards. When this happens, power can flow from the Tableau forensic bridge into the host computer through the FireWire host adapter. Unless you are very good with a soldering iron, the only solution is to use a different FireWire host adapter which is properly manufactured. This is not a defect in the Tableau forensic bridge.

Will Tableau forensic bridges work with Windows 7?

Yes. Windows 7 will recognize and mount devices connected to Tableau forensic bridges. However, there is a known compatibility issue using Tableau Firmware Update (TFU) with the native Windows 7 1394 bus driver, which was fixed in TFU version 6.61.

The following workaround will allow versions of TFU prior to v6.61 to work properly over FireWire under Windows 7:

• Navigate to the Windows 7 Device Manager and click on the "plus" icon next to "IEEE Bus host controllers".
• Right-click the IEEE 1394 Host Controller and select "Properties".
• Click the "Drivers" tab and select "Update Driver".
• Select "Browse my computer for driver software".
• Select "Let me pick from a list of device drivers on my computer".
• In the selection screen, choose "1394 OHCI compliant host controller (Legacy)" and click "Next".
• The legacy driver will install and your Tableau utilities will now communicate properly over FireWire.

Do Tableau bridges support NTFS on Windows 2000?

Yes. Tableau forensic bridges can be used to image read-only NTFS volumes under Windows 2000.

Why is this an issue? Some forensic bridges work in such a way that they prevent Windows 2000 from mounting a read-only NTFS volume. Tableau bridges are the most versatile forensic bridges on the market and include configuration options which allow you to achieve optimal performance, no matter which operating system you are using.

As shipped by the factory, Tableau bridges are configured to work optimally with Windows XP and other modern OS's like OS X. However, using switch settings on the Tableau bridge, you can change the configuration for use with Windows 2000 or even older systems like Windows 98se.

If you are running Windows 2000 and you need to image NTFS volumes using a Tableau bridge, turn switches 2 and 3 ON. Switch 1 should be OFF to configure the bridge for read-only (forensic) mode.

If you are using Windows XP or other modern OS's, leave switches 2 and 3 in the OFF position for optimal performance.

Will I always be able to mount (see) logical drives on write-blocked Tableau forensic bridges?

The short answer: In most cases, yes, you can see the logical volumes. But in some cases an operating system like Windows XP will not mount the logical drives on a hard disk connected to a Tableau forensic bridge. However, even in these cases you will still be able to access the hard disk on a physical level and extract a forensically sound image using standard forensic imaging software.

By way of explanation, some operating systems, notably certain versions of Microsoft Windows (e.g., Win XP) will not mount a logical volume unless they can write to the drive on which the volume is located. Tableau forensic bridges in write-blocking mode will not permit writes to a drive, and any writes attempted by such operating systems will be blocked.

For example, hard disks originally formatted/partitioned under Windows 98 do not have an "NT Drive Serial Number" in the MBR (Master Boot Record, sector 0, offsets 0x1b8-0x1bb). Before mounting the logical drives on such a hard disk, Windows XP attempts to write a non-0 serial number into the MBR. If it can both write the serial number and read it back, then Windows XP will mount the logical volumes the hard disk. If not, Windows will still create a physical device (i.e., "\\.\PhysicalDiskX") for the hard disk.

It is interesting to note that other OS's, like Linux and Mac OS X, will mount the logical volumes on the same drives without difficulty when using Tableau forensic bridges.

For those who are curious, it is technically feasible to fool Windows into thinking that the write to the Master Boot Record has succeeded by keeping the data written to the MBR in the memory of the forensic bridge and then returning that data on subsequent MBR reads (a competing forensic bridge vendor has implemented just such a scheme). However, Tableau does not believe this is wise solution. Without absolute knowledge of the algorithms used by each forensic imaging software (and each version thereof), it is possible that the "cached" MBR data could become part of a forensic image or hash calculation, thus casting doubt on the credibility of the forensic image.

I'm using Linux Kernel 2.6.10 or later and the Tableau bridge isn't working when I connect it to the computer via USB. What's wrong?

Linux distributions based on Kernel 2.6.10 and later may have problems communicating with a Tableau T3u, T4, T5, or T8 when the Tableau bridge is connected to the computer via USB.

To resolve this problem, update the firmware in your Tableau bridge using Tableau Firmware Update v3.30 or later.

I'm using Linux Kernel 2.6.17 or earlier and the Tableau bridge isn't working when I connect it to the computer via the 6-pin (FireWire 400/1394A) connector. What's wrong?

If your computer has a 1394B (FireWire 800) host adapter, then older Linux kernel releases will try to communicate at FireWire 800 speed even when 6-pin FireWire 400 cabling is used.

To avoid this problem, either use only 9-pin FireWire 800 cabling or switch to Linux kernel 2.6.18 or newer. These kernel releases are capable of downgrading to FireWire 400 speed when using 6-pin cables.

I'm using Windows and I have a 1394B host adapter. When I connect this host adapter to the 6-pin (FireWire400/1394A) connector on my Tableau bridge, Windows doesn't recognize the bridge. What's wrong?

Microsoft's official position is that they do not yet support 1394B. So, even though 1394B works correctly in most situations with Windows, not everything works perfectly.

This is an example of one of these problems. When you have two 1394B-capable devices, in this case the 1394B host adapter and the Tableau bridge, Windows doesn't pay attention to the fact that those devices may be connected over a 1394A link (i.e., the 6-pin connector on the Tableau bridge). Windows therefore tries to send "S800" (800Mbit/sec) packets over the "S400" (400Mbit/sec) connection, and that doesn't work.

To avoid this problem, always use a 9-pin 1394B-to-1394B cable to connect a 1394B host adapter to one of the FireWire800/1394B ports on the Tableau bridge. This will always work correctly.

When I connect two Tableau bridges to my computer at the same time on the same FireWire bus, sometimes Windows doesn't see one or both of the bridges. What's wrong?

Tableau bridges with firmware date codes before Mar 25 2004 have a firmware bug which sometimes prevents the bridges from being recognized properly when connected to fast Windows PCs (e.g., PCs faster than about 2.8GHz), and this problem is most often witnessed when attempting to daisy-chain two or more Tableau bridges on the same FireWire/1394 bus.

To fix this problem, use the Tableau Firmware Update to update the firmware in your Tableau bridges.

When I connect two Tableau bridges to my computer at the same time via USB, they don't seem to work correctly. What's wrong?

Tableau bridges with firmware date codes before February, 2005 have a firmware bug which causes problems when you connect two or more Tableau bridges to a computer at the same time using USB.

To fix this problem, use the Tableau Firmware Update to update the firmware in your Tableau bridges. This problem is fixed in Tableau firmware with date codes of February, 2005 and later.

I'm using a USB connector on the front of my computer and my computer is not seeing the Tableau forensic bridge. When I use a USB connector on the back of my computer everything is OK. What's wrong?

Believe it or not, most computers which have a USB connector on the front of the computer are actually violating the USB specification. This is true even of computers from a number of "name brand" PC vendors. The USB specification does not allow cable extenders, and the USB connectors on the front of most computers are fed by just such a cable extender.

USB cable extenders degrade USB signal quality. When using a high-performance interface like USB 2.0, this signal degradation can cause the USB interface to malfunction. If you must use the USB connector on the front of your computer, use only high quality USB 2.0 cables to connect your computer to the Tableau forensic bridge.

NOTE: Some vendors now offer USB hubs which can be mounted in the front of a computer and which provide external USB connectors which are accessible from the front of the computer. These hubs regenerate the USB signals and do not violate the USB specification.

I already have an IDE, SATA, or SCSI cable. Can I use these cables instead of the IDE, SATA, or SCSI cables sold by Tableau?

Tableau encourages you to use Tableau IDE, SATA, and SCSI cables when using Tableau forensic bridges. Tableau tests its forensic bridges with its own cables, and these cables are known to work reliably with Tableau's forensic bridges.

SCSI, in particular, offers many different cabling alternatives and levels of quality. For this reason, Tableau strongly encourages customers to use Tableau's TC10-8 SCSI cable when using the T4 SCSI bridge.