This bulletin is an update to the T6es Product Bulletin published on March 25, 2011.

Guidance Software has fully characterized the previously-reported manufacturing problem with the Tableau T6es SAS Forensic Bridge. The problem has been traced to a specific IC (integrated circuit) which was failing to operate correctly over the expected temperature range for the T6es. The problem was not present in T6es prototypes and appeared when a new "stepping" (or version) of this IC entered the component/manufacturing supply chain. GSI engineering has determined that the problem can be fixed by a simple change to the T6es circuit board. The change alters the behavior of the IC in question (both new and old steppings), placing this IC in a mode in which it works correctly across the expected range of T6es operating temperatures.

As noted earlier, the write-blocking feature of the T6es was never compromised by this issue. Likewise, GSI engineering has confirmed that the problem was not due to overheating and consequently this issue poses no danger of damage to the T6es or to equipment attached to the T6es. GSI engineering has also conducted a design review of other Tableau brand products which use the same IC and has concluded that none of those products are affected by this issue.

Guidance Software is instituting a recall of T6es units shipped between September, 2010, and March, 2011. Guidance Software will repair or replace T6es units affected by this issue. Customers will be responsible for shipping costs to Guidance Software or to one of its reseller partners. Guidance Software will pay for repair/replacement and return shipping. This recall will remain open for a period of two years, ending March 31, 2013. This recall campaign does not affect or extend Guidance Software's normal warranty policy for T6es failures unrelated to this manufacturing issue.

Units subject to this recall may be identified by the model designation "Tableau T6es" shown on the back label of the T6es unit. All T6es units shipped beginning April 1, 2011, will have been reworked by the factory to fix this problem. All reworked units and all units manufactured after April 1, 2011, have the updated model designation "Tableau T6es-B" shown on the back label and are not subject to this recall.

Guidance Software is planning to make a rotating supply of reworked T6es-B units available to its reseller partners so they can swap-out / replace units from their locations. Guidance Software will make details of this swap-out program available to its reseller partners through a separate communication.

Again, we apologize for the inconvenience caused by this issue, and we appreciate the ongoing patience and support of our end users and reseller partners.

We recently discovered a firmware fault in the T8-R2 firmware which made it possible for the write-blocking feature of the product to be partially circumvented (when using the USB host-side connection, it was possible for a "write" command, but no host-originated data - to pass through to the subject device). We identified and corrected a specific defect in the firmware and are confident that this particular problem will not recur.

We do not believe this error will be triggered in the normal use of the T8-R2 to acquire subject devices, and therefore we believe it highly unlikely that any subject devices or acquisitions were compromised as a result of this error. The error was revealed by one of our training partners when they made a specific attempt to wipe the attached storage device. Casual or unintentional attempts to write to the subject device would have been blocked as expected.

NOTE: The T8-R2 replaced the earlier Tableau T8 in May, 2010. The earlier T8 is not affected by this issue. The T8-R2 and the older T8 are easily distinguishable. The T8-R2 has a "membrane keypad" power switch on the face of the unit while the older T8 has a physical rocker-style power switch on the right edge of the unit. Additionally, the label on the back of the units clearly identifies the Tableau part number ("Model T8" or "Model T8-R2").

We would like to say that it is impossible for a similar problem to happen in the future. However, this is simply not true. The complexity of modern electronics and firmware is such that bugs are inevitable, and some of those bugs may even be severe. However, we have instituted specific new protocols, tightening our quality control procedures in order to prevent this kind of error in the future. In particular, we have developed a new in-house write-blocker penetration testing tool and will use this tool to qualify all future write blockers and write blocker firmware. Also, we have conducted an internal review of our other write blockers to make sure that none contains a similar defect to the one recently found in the T8-R2.

Finally, should concerns over bugs arise in the future, we remain committed to characterizing all serious bug reports and fixing any serious defects promptly. Most importantly, we remain committed to the open and transparent disclosure of any such bugs to the forensic community. Simply put, we believe there is no other ethical, responsible approach that we can take when dealing with such issues, even though they may be embarrassing or damaging to us as a company.

We thank you for your patience and continued support.

Guidance Software has identified an apparent manufacturing problem with the T6es SAS Forensic Bridge. At this time it appears that there is a component in the T6es which is not working correctly over its rated temperature range. As the T6es heats during normal operation, this component may stop functioning and data transfer through the T6es will cease.

The T6es is operating within its expected temperature range, but one of the components is not working correctly across the expected temperature range. There is no danger of fire nor is there danger of damage to equipment attached to the T6es.

This manufacturing defect/problem does not compromise the write blocking feature of the T6es. However, when the T6es stops transferring data, certain forensic imaging applications may incorrectly conclude that the subject disk has bad sectors and "zero-pad" the resulting forensic image. If this happens, the imaging application should produce an error log and that log should show an abnormally high number of "read faults" on the source/subject device. If no errors have been detected during imaging, then it is very likely that the T6es is working correctly and that the forensic image is completely valid.

The GSI hardware and manufacturing/operations teams are working to identify the number of T6es units which are subject to this problem and to implement a solution. The failing component appears to be from a bad batch of components provided by one of our vendors. Some T6es units have been assembled with parts from this bad batch and some have been assembled with components which appear to function correctly. At this time we do not have a simple way for end users to identify whether or not a given T6es is built with the failing component.

We expect that our teams will need several weeks to fully characterize and solve this problem during which time we will keep the T6es on ship-hold status. We will continue to update our resellers and end users as we learn more regarding this problem.

We regret any inconvenience to our customers and appreciate your patience and support as we work through this issue.

Tableau has identified a problem with TIM versions 1.0 and 1.1 in which images are created with corrupt .e01 chunk offset arrays when multiple jobs are scheduled using the "Immediate" scheduling option and the "EnCase .e01" file format. Users will receive errors when attempting to process these images for analysis. Specifically, EnCase will display CRC errors, and FTK will display decompression errors.

This problem only occurs when using the specific combination of imaging options noted above, and when running more than one job simultaneously. Also, please note that the corruption which occurs is limited to the offset arrays within the .e01 file set; the compressed sector data from the source drive is not affected.

All TIM users are advised to upgrade to TIM v1.11 or later to avoid this problem.

Tableau has identified a problem with the T10, T14, and T345 forensic bridges which can cause these bridges to mis-read data from older IDE hard disks which support only UDMA (Ultra DMA) modes 0, 1, and 2. When this problem occurs, data read from the subject hard disk may be corrupted. In most situations, this makes the subject hard disk appear to be unpartitioned.

NOTE: This problem would not occur with hard disks which support UDMA mode 3/later or with hard disks which support only DMA and PIO modes. Likewise, no such problems have been observed with Tableau's Classic Family of forensic bridges, including the T5.

Tableau recommends that all T10, T14, and T345 users update their firmware to v3.33 or later.

There is a POTENTIALLY SERIOUS bug in T15 firmware with date codes prior to Sep 07 2005. If you have removed the plastic knock-out panel on a T15 and attempted to switch the unit into read-write mode (DIP switch 1 on the T15), the T15 does switch into read-write mode, but the "WrBlk" LED remains illuminated. For users who have removed the plastic knock-out panel on the T15 it is especially important to apply this Tableau Firmware Update.

All T15 units shipped as of this writing have been read-only units shipped in black plastic cases; and the knock-out plastic panel (which, when removed, provides access to the internal DIP switches on the T15) is always in place as shipped by the factory. This includes T15 units sold as "FireFly(tm) SATA" by Digital Intelligence. As shipped by the factory, the "WrBlk" LED on these units is illuminated, correctly indicating that the unit is in read-only mode.

Tableau believes only a handful of T15 users - those who have removed the plastic knock-out panel and attempted to switch T15 units into read-write mode - will be affected by this problem. Further, Tableau believes that most, if not all, of these users have or will notice that the WrBlk LED incorrectly remains illuminated after turning DIP switch 1 to the ON position, and that these users have or will contact Tableau or its distributors for assistance.

Nonetheless, Tableau encourages all T15 customers to apply this firmware update.

NOTE: Tableau has verified that other Tableau products, including the T3, T3u, T4, T5, T8, T10, T14, and T345 are not affected by this problem.

Tableau has released v2.0 of the Tableau Firmware Update to address problems created by Microsoft's release of SP2 (Service Pack 2) for Windows XP.

Microsoft's SP2 update for Windows XP includes 1394/FireWire drivers which incorrectly handle 1394B/FireWire800 devices such as Tableau's line of forensic bridges. Users who install Windows XP SP2 may notice a severe reduction in data transfer performance when using 1394/FireWire to connect Tableau bridges to the host computer.

Tableau has implemented a firmware "workaround" for the errors in Microsoft's Windows XP SP2 1394/FireWire drivers, allowing users to continue to take full advantage of the high performance of which Tableau's forensic bridges are capable.

Tableau has identified a bug in the firmware of the T4 FireWire800+USB2.0 SCSI bridge which causes the T4 to report a disk size which is one sector shorter than the actual length of the hard disk. All T4 users should download and install the Tableau Firmware Update to correct this bug.

For your convenience, Tableau has prepared a PDF Product Bulletin which describes this bug in more detail.

While the T3/T3u SATA bridges and T5 IDE bridge do not have this bug, users of these products may also find the Tableau Firmware Update to be useful.