The Four Expectations of Forensic Hardware You Need to Know
Digital Forensics | Jul 20, 2016
At Guidance, we develop our Tableau forensic hardware products with the needs of forensic investigators in mind. There is no greater honor for our company, than having the Tableau TD2u Forensic Duplicator recognized by the forensic investigations community as the Computer Forensic Hardware of the Year. Because we’ve been active in digital forensics for almost twenty years, we know how to make completing digital investigations easier, and that might be why we’ve won a Forensic 4:Cast award every year, for eight years running. We also understand that with every new product release, expectations are high and that there are many options for forensic imaging and forensic hardware. To ensure we can meet or exceed these expectations, we build our products around four principle expectations of forensic hardware:
1. The ability to produce forensically-sound evidence. It doesn’t matter how fast, or how many bells and whistles a duplicator has, if the fundamental forensic integrity of the device can be called into question. This is why all Guidance forensic duplicators and imagers always provide both an MD5 and a SHA-1 hash (simultaneously) of the suspect volume, to ensure reliable chain-of-custody tracking, across all major forensic software tools. This functionality is absolutely essential for a forensic duplicator.
2. Reliable speed. Let’s face it, imaging drives is not the speediest process, especially given the ever increasing size of drives. That said, there is very little more frustrating for an investigator than working through a stack of drives and seeing the imaging speeds fluctuate wildly. This is why we develop forensic hardware with consistent performance in mind. With imaging speeds greater than 17GB/min and wiping speeds in excess of 25GB/min, the TD2u gives investigators the performance they need to reduce backlog, while imaging a variety of suspect devices (USB3, IDE, SATA, SAS). Additionally, simultaneous output (1:2 or 1:3) allows for multiple copies of evidence to be created, again saving time. Evidence drives can even be AES whole-disk encrypted by the TD2u, with trivial impact to imaging speeds.
3. High value, and low total cost of ownership (TCO). Value is a combination of price, great functionality, a top-tier sales channel, and bulletproof product support. Low TCO comes from a product update and upgrade policy that never charges for firmware updates, even when the updates deliver significant new features (like AES Whole-Disk Encryption), enhanced device support, or increased performance. With Tableau products you get free firmware upgrades for the entire lifecycle of the product, making repeated ‘software enablement’ charges a thing of the past.
4. Focus, with flexibility. Tableau forensic imaging and write-blocking products squeeze every ounce of performance out of our hardware architecture. We know forensic investigators depend on our products, and our focus is on delivering best-in-class forensic hardware to meet both in-the-field and lab needs. We don’t make generic drive duplicators, storage systems, or any other products that would distract from producing the best digital forensic acquisition hardware in the world. Our focus, along with the skill and determination of some of the best forensic hardware developers in the world, sets Guidance apart.
We are truly grateful for the continued recognition the forensic community gives our Tableau products and will continue to work hard to make sure we deliver the best forensic hardware products available.
For more information on Tableau Forensic Hardware visit - https://www.guidancesoftware.com/tableau
Jeff Hedlesky is a Forensic Evangelist at Guidance Software and a business development professional with 25 years of experience connecting people and technology.