Tableau Frequently Asked Questions

Topics

Tableau Forensic Duplicators

  • Q: Does the TD1/TD2 write-protect the source drive?
  • A:

    Yes, as the TD1/TD2 is a forensic duplicator, write-protection is a native function of the duplicator. The source drive (connected to the left side) is always write-protected, therefore the duplicator will never allow writes to the source drive.

  • Q: How fast is TD1 at duplicating hard drives?
  • A:

    TD1's drive operation performance (duplicating, hashing, wiping, etc.) will of course be limited by the slowest drive being used.

    If you are using fast drives and have high quality cables (such as the Tableau cables supplied with the TD1 kit) you can achieve rates up to 6GB/min.

  • Q: Will duplication performance decrease if I use hashing on the fly with TD1/TD2/TD3?
  • A:

    Due to the high-performance architecture of TD1/TD2/TD3, on the fly hashing (for both SHA-1 & MD5) is always enabled. Our duplicators were designed to support simultaneous SHA-1 and MD5 hashing while duplicating drives without compromising drive performance.

  • Q: How should I configure the drive select jumper on an IDE hard drive to work properly with the TD1/TD2/TD3?
  • A:

    An IDE hard drive needs to be configured as Master or Single (depending on the drive manufacturer) to work properly with the TD1/TD2/TD3. Refer to the label on the drive or the drive manufacturer's website for specific jumper instructions.

  • Q: What hard-sided cases fit the foam insert included with the TD1/TD2 kit?
  • A:

    As shipped by Tableau, the TD1/TD2 kit includes a foam insert which holds and organizes the duplicator and its accessories. This foam insert can be removed from the cardboard box provided by Tableau and reinstalled in any of several industry-standard hard-sided cases, including:

    • Pelican Model 1450
    • Explorer Model 30/3818

  • Q: The TD1/TD2 is not recognizing my USB device?
  • A:

    The USB ports on the TD1/TD2 are for use with USB thumb drives (for saving logs), USB printers (for printing logs), and for USB keyboards (for faster data entry into the duplicator).

    The USB interface in the TD1/TD2 is technically similar to the USB interfaces found in Tableau Forensic Bridges with write-blocked USB ports. If the TD1/TD2 is failing to recognize a specific USB device, please refer to the FAQ section on USB Write-Blocking. You may find suggestions in that section which help you to resolve USB compatibility issues with the TD1/TD2.

USB and FireWire Write-Blocking

  • Q: What kinds of USB devices do Tableau USB write blockers support?
  • A:

    The T8/T3458is/T34589is Forensic Bridges are currently designed to work with USB Mass Storage Class devices. This includes most USB "thumb drives," many USB digital cameras, Apple iPods with USB interfaces, hard disks in external USB enclosures, etc.

    From a technical standpoint, the Tableau USB write blockers support USB devices which conform to USB Class 8 (Mass Storage), Subclass 2 (SFF8020I), SubClass 5 (SFF8070I), or Subclass 6 (SCSI). Additionally, the Tableau USB write blockers require that the USB device implements Protocol 50h (Bulk Only).

    NOTE: The Tableau T8 originally supported only Subclass 6 (SCSI). Support for Subclasses 2 (SFF8020I) and 5 (SFF8070I) were added as part of Tableau Firmware Update v3.30. This firmware update corresponds to T8 firmware date codes of Oct 19 2005 and later.

  • Q: Can Tableau USB write blockers work with compound USB devices?
  • A:

    A compound USB device is a USB device which incorporates multiple functions in a single unit. Tableau USB write blockers may be able to work with such devices, but this is not guaranteed. The order in which the compound USB device's functions are enumerated determines whether or not the device will work in conjunction with the Tableau write blockers. Additionally, as noted in the previous FAQ, Tableau USB write blockers work with devices conforming to the USB Mass Storage Class specification.

  • Q: Do Tableau USB write blockers work with USB memory card readers?
  • A:

    Tableau USB write blockers work with some USB memory card readers. Whether or not the Tableau USB write blocker works with a specific USB memory card reader depends on the internal design of the memory card reader.

    For example, USB memory card readers often support more than one type of memory card/slot. If the USB memory card reader reveals itself on the USB interface as a single USB device (or "function" in USB parlance), then the Tableau write blocker will generally work well with the USB memory card reader. However, if the USB memory card reader reveals each memory card/slot as a different USB device -- that is, the USB memory card reader presents itself as a compound device -- then the Tableau write blocker may not work as expected. The Tableau write blocker will "lock onto" the first mass storage device it finds, ignoring the others. If a memory card is inserted into a slot in the reader which isn't the "first" device, then the T8 won't find the memory card.

    Unfortunately, it is very difficult to know without testing how a given USB memory card reader is implemented. USB memory card readers which have only a single memory card/slot will generally work with Tableau USB write blockers.

  • Q: The Tableau USB write blocker is not seeing my USB device. What can I do?
  • A:

    Under certain circumstances a Tableau USB write blocker will fail to recognize a USB device if it is attached to the write blocker before the write blocker has been turned ON. As a workaround, try turning ON the write blocker first, then attaching the problematic USB device. This may allow the write blocker to recognize the device properly.

  • Q: The Tableau USB write blocker is not seeing my USB external storage device. What can I do?
  • A:

    There are two important details that will help you acquire external storage devices that require larger amounts of power over the USB bus.

    • First verify that you are using the most current firmware release for your Tableau USB write blocker. Many large bus-powered external storage devices were unsupported until Tableau Firmware Update v6.20 (T8 firmware timestamp: Nov 06 2008 14:40:57).
    • Most bus-powered external storage disks will require an auxiliary power supply. There are two ways this can be accomplished. The safest method is to power the external device through a powered USB hub. Unfortunately the way a hub is implemented varies by manufacturer and not all powered hubs will work. A more reliable option (potentially risky!) is to use a USB power "Y" cable, where power is borrowed from the host. Forensic examiners must be particularly cautious with this configuration since it would be easy for a careless examiner to mount a drive to the host computer in "RW" mode.

  • Q: When mounting some FireWire/USB devices through a Tableau write blocker the Activity LED remains solid for a long period of time. What's wrong?
  • A:

    Some drives have a file system structure that Windows wants to interrogate extensively upon mounting, which results in a potentially large number of small I/O requests. When mounting these drives through a Tableau USB or FireWire write blocker the Activity LED remains on constantly during this scan. This process may take 10-60 seconds, but once the scan is complete the drive may be imaged or browsed normally.

SCSI Write-Blocking

  • Q: Will Tableau SCSI bridges work with Ultra320 SCSI hard disks?
  • A:

    Yes, Tableau SCSI bridges should be compatible with hard disks including Ultra320 hard disks.

    The SCSI standard requires devices to be backwards-compatible with slower transfer modes, for example, so that new hard disks can be compatible with slower host adapters and vice-versa. Tableau SCSI bridges support SCSI transfer modes up to Wide Ultra 2 SCSI -- also known as Wide FAST-40 -- for a maximum transfer rate of 80MB/sec. The Tableau SCSI bridges will "negotiate" with the SCSI hard disk to determine a mutually acceptable SCSI transfer mode.

  • Q: Will Tableau SCSI bridges work with HVD SCSI?
  • A:

    No, Tableau SCSI bridges do not directly support the older SCSIHVD (High Voltage Differential) standard. However, some companies manufacture HVD-LVD converters which can be used to convert the HVD interface on an older hard disk to the LVD standard supported by Tableau products.

  • Q: What does it mean when the SCSI Detect light on the Tableau SCSI bridge is blinking?
  • A:

    After the T4 SCSI bridge is turned ON, it begins scanning the SCSI bus searching for a device. If the SCSI device is ready for operation, the T4 turns ON the SCSI Detect light. If the SCSI device is not ready, the T4 flashes the SCSI Detect LED until the SCSI device reports that it is ready for operation. If the SCSI DetectLED never stops flashing that most likely means the SCSI device is malfunctioning.

  • Q: Do I need to jumper a SCSI device for a specific SCSI ID when I'm using a Tableau SCSI bridge?
  • A:

    Tableau SCSI bridges automatically search SCSI addresses 0..6 and 8..15 for an attached SCSI device. The Tableau SCSI bridge itself uses the fixed SCSI ID 7, which is "standard" for host adapters. So, you only need to change a device's SCSI ID if it also happens to be set forSCSI ID 7, as that would conflict with the Tableau bridge's own SCSI ID.

  • Q: Can I attach more than one SCSI device to a Tableau SCSI bridge at the same time?
  • A:

    No. Tableau SCSI bridges are only intended to work with a single SCSI device at a time.

  • Q: What is the meaning of the two LEDs (one green and one yellow) on the side of the T4 SCSI bridge?
  • A:

    The green and yellow LEDs on the side of the T4 next to the HD68SCSI connector indicate whether an LVD (Low Voltage Differential) or SE (Single-Ended) SCSI device is plugged into the T4. The green LED indicates LVD and the yellow LED indicates SE.

    NOTE: Other Tableau SCSI-capable bridges (e.g., Tableaumodels T345/T3458is/T34589is) do not have externally visible LEDs to indicate the type of SCSI device detected by the bridge.

  • Q: Do Tableau SCSI bridges terminate the SCSI bus?
  • A:

    Yes, Tableau SCSI bridges terminate the SCSI bus. The SCSI specification requires termination at each end of the bus. So, for proper operation, the SCSI device should also be terminated. Most modern SCSI devices have jumper options to enable termination.

  • Q: Why don't the T3 SATA bridge and T5 IDE bridge have ventilation slots like the T4 SCSI bridge?
  • A:

    The T4 SCSI bridge consumes approximately 50% more power than the T3/T3u SATA and T5 IDE bridges. When Tableau's engineers designed the T4 they decided that the extra heat dissipated by the T4 warranted the addition of ventilation slots.

    While the T3/T3u and T5 do not generate enough heat to require ventilation, Tableau has decided to standardize future case production and all products will incorporate ventilation slots beginning in late 2004.

eSATA

  • Q: What is eSATA and how is it different that SATA?
  • A:

    eSATA (external Serial ATA) is an extension to the SATA (Serial ATA )standard, which enables SATA drives to be attached to a host computer externally. Although eSATA uses identical protocol signaling as SATA, the physical connector is different. The most obvious difference is that the eSATA connector is straight instead of the "L" shaped SATA connector. eSATA cables also contain an extra layer of shielding and the connectors have metal contact points to reduce EMI. The plug is also deeper to help protect against ESD (Electrostatic Discharge).

  • Q: What type of cable should I use to connect my Tableau eSATA Forensic Bridge to my host's eSATA port?
  • A:

    eSATA cables can be up to two meters (approximately six feet) in length. Tableau offers two lengths of eSATA cables for purchase, the TC9-1M (one meter length) and TC9-2M (two meter length). The TC9-1M cable is included in the TK35es Forensic eSATA Bridge Kit.

    Be careful when using eSATA cables other than Tableau's. During our eSATA testing, we noticed some manufacturer's eSATA cables that didn't fully conform to the eSATA physical spec and therefore didn't always work properly.

  • Q: Is eSATA a hot-pluggable connection type?
  • A:

    Although eSATA is designed to be a hot-pluggable connection type, this feature requires proper support at the host, device, and controller level. Unfortunately, not all eSATA controller manufacturers properly support hot-plugging yet.

    It is recommended that before disconnecting an eSATA device from your host, you safely eject the device, just as with unmounting a FireWire or USB device. If the eSATA controller does not offer this capability, it may be necessary to power down your machine before an eSATA device can be safely removed.

    As with all forensic tools in your arsenal, please test your equipment before attempting to perform an acquisition of an evidence drive.

  • Q: Is eSATA faster than FireWire 800?
  • A:

    Yes, eSATA is faster than FireWire 800. With fast enough source and destination SATA hard drives, and an eSATA controller card, using an eSATA connection will yield faster transfer rates than FireWire 800. The maximum *theoretical* transfer rate of an eSATA 150 connection is 1.5Gb/s (or 150MB/s), and an eSATA 300 connection is 3.0Gb/s (or 300MB/s). Whereas FireWire 800 has a maximum *theoretical* transfer rate of 800Mb/s (or 100MB/s).

    Keep in mind that these transfer rates are *theoretical* and not what you will actually achieve.

Tableau Support for HPA and DCO

  • Q: Do Tableau bridges support HPA/DCO?
  • A:

    Yes, with Tableau firmware released in October of 2005, Tableau IDE and SATA bridges can detect and override both HPA (Host Protected Area) and DCO (Device Configuration Overlay) regions on a hard disk.

    HPA and DCO refer to specific mechanisms that can be used in IDE and SATA hard disks to "hide" regions at the "end" of a hard disk. Commands related to HPA and DCO are defined in the ATA specifications for hard disks, and these commands are often used by computer manufacturers to hide, and thus protect, recovery partitions located at the end (or top) of the hard disk.

    In theory, HPA and/or DCO commands could be used to hide user data as well. In practice, Tableau believes this kind of data hiding is unlikely to be seen in the field.

    To upgrade your Tableau IDE or SATA bridges with support for HPA/DCO, please download the Tableau Firmware Update.

  • Q: How do Tableau bridges handle HPA and DCO?
  • A:

    Upon detecting an IDE or SATA hard disk, Tableau bridges with HPA/DCO support (see above) will attempt to detect if the hard disk supports HPA or DCO and if HPA or DCO is being used to protect a region at the end of the hard disk.

    If HPA is being used to protect a region at the end of the hard disk, the Tableau bridge will automatically use "volatile" HPA commands to override the HPA setting, immediately making the HPA region visible to the host computer so normal imaging tools can access the data in the HPA region.

    If DCO is being used to protect a region at the end of the hard disk, the Tableau bridge will not automatically override DCO. To do so, the Tableau bridge would need to send a permanent (i.e., non-volatile) command to the hard disk, and this would permanently alter the hard disk's DCO settings. Instead, Tableau plans to release utilities which can be used in conjunction with Tableau bridges in order to override the DCO settings at the explicit direction of the user.

  • Q: Will Tableau's HPA/DCO support alter the hard disk permanently?
  • A:

    The commands needed to override HPA can be used in a "volatile" mode, so the changes are temporary and the hard disk will be returned to its original state after it is power-cycled.

    The commands needed to override DCO are permanent, so they will be retained even after the hard disk is power-cycled. For this reason, a Tableau forensic bridge will never send DCO commands to a hard disk except under the explicit control of the user.

IDE Notebook Drive Adapters

  • Q: What is the purpose of the jumper located on the top of my Tableau TDA5-18 1.8" IDE adapter?
  • A:

    The jumper labeled JP4 on the TDA5-18 adapter is for forcing the IDE drive mode. Although seldom used by 1.8" drives, this jumper allows the user to set the drive mode using the following pin settings:

    • Master: None
    • Slave: 1-2 or 3-4
    • CSEL: 2-4

  • Q: How do I connect a 1.8" ZIF hard drive to my Tableau TDA5-ZIF IDE adapter?
  • A:

    ZIF drive cables and connectors are very fragile, so take extra care when working with ZIF components.

    Currently there are five known manufacturers of ZIF drives: Hitachi, Samsung, SanDisk, Seagate, and Toshiba. There are multiple variations of which cable to use, and which way to position the drive while connecting to the ZIF adapter. Follow the steps below to determine how to connect your particular ZIF drive.

    To image a Hitachi drive, connect the Tableau TC20-3-3 ZIF cable to the adapter label face-up. Then connect the cable to the Hitachi drive, positioning the drive label face-up.

    To image a Samsung 1.8" drive, connect the Tableau TC20-3-2 ZIF cable to the adapter label face-up. Then connect the cable to the Samsung 1.8" drive, positioning the drive label face-up.

    To image a Samsung SSD drive, connect the Tableau TC20-3-2 ZIF cable to the adapter label face-up. Then connect the cable to the Samsung SSD drive, positioning the drive label face-down.

    SanDisk SSD drives require a special cable not included with the TDA5-ZIF adapter kit. Tableau is currently researching a cable that is compatible with the SanDisk SSD ZIF drives.

    To image a Seagate Lyrion drive, connect the Tableau TC20-3-2 ZIF cable to the adapter label face-up. Then connect the cable to the Seagate drive, positioning the drive label face-up.

    To image a Toshiba drive, connect the Tableau TC20-3-2 ZIF cable to the adapter label face-up. Then connect the cable to the Toshiba drive, positioning the drive label face-down.

  • Q: Why is my Tableau TDA5-ZIF adapter not working with a SanDisk SSD ZIF drive from an HP-Mini or MacBook Air?
  • A:

    SanDisk SSD ZIF drives use a unique connector type which is different than what is currently used by other ZIF disk manufacturers. Tableau does not currently offer a cable which is compatible with the SanDisk SSDZIF drives and is currently researching cables that will allow an investigator to use these drives with the TDA5-ZIF adapter.

Compatibility Issues

  • Q: Are Tableau products compatible with every device ever made?
  • A:

    Tableau strives for 100% device compatibility. However, there are limited situations in which Tableau cannot make its products compatible with certain models of devices. Tableau maintains a list of known/documented incompatibilities here.

  • Q: My SCSI device is not recognized by my Tableau T3458is (or T34589is).
  • A:

    Certain SCSI drives draw too much current during spin-up to work correctly when powered through the Molex power connector on the front of a Tableau T3458is or T34589is.

    Please refer to the list of incompatible devices for more information and for suggested workarounds.

  • Q: I'm trying to acquire a Super Talent 8GB SATA flash drive with a Tableau forensic bridge, and I'm getting really slow transfer rates. What's wrong?
  • A:

    The Super Talent 8GB 2.5" SATA Solid State Drive (model #FSD8GC25M) has a low-level communication incompatibility with the SATA chipset used in some older revisions of Tableau bridges.The symptom is extremely slow data transfers. This incompatibility will occur with all versions ofthe Tableau bridge models T3 and T3u. This will also occur with bridge models T15 and T345, but only with versions manufactured prior to July 1, 2006.

    All other Tableau SATA bridge models should work properly with this drive; e.g., T35i, T35e, T35es.

Tableau Software

  • Q: Why is it necessary to have firmware updates?
  • A:

    Firmware updates give Tableau the ability to fix bugs and add features to Tableau forensic bridges in the field.

    Forensic bridges are complicated products, and sometimes -- as much as we try to avoid it -- there will be bugs that make it into the field. Tableau is committed to providing the best support in the industry for its products and the Tableau Firmware Update is proof of that commitment.

    And, the Tableau Firmware Update is not just for bug fixes. The Tableau Firmware Update is also used to deliver firmware with enhanced features to Tableau bridges already in the field. So, it doesn't matter if you buy your Tableau bridge today or later. You will always be able to update your Tableau bridge with the latest firmware and features available for your bridge.

  • Q: How do I know which firmware update to use for my Tableau bridge?
  • A:

    There is only one Tableau Firmware Update program. The Tableau Firmware Update contains firmware images for each different type of Tableau forensic bridge. When you run the Tableau Firmware Update, it detects the type of Tableau bridge connected to the computer and automatically selects the appropriate firmware for that bridge.

  • Q: Can I use the Tableau Firmware Update to update more than one Tableau bridge at a time?
  • A:

    Yes, the Tableau Firmware Update allows multiple Tableau devices to be connected to the computer at the same time.

    The Tableau Firmware Update shows the firmware timestamp for each Tableau product connected to the computer. The Tableau Firwmare Update also indicates whether it has newer firmware, the same firmware, or even older firmware than the firmware which is already installed in each product.

  • Q: Will the Tableau Firmware Update work with USB?
  • A:

    No, at the present time the Tableau Firmware Update only works when you connect the Tableau bridge to the computer using FireWire.

  • Q: What happened to the TabTest beta software utility?
  • A:

    The TabTest beta software utility was discontinued and removed from the website on February 10, 2012. We will continue to provide limited support for existing TabTest users, but there will be no further modifications or releases for this software. This limited support will be phased out over time.

Third Party Software

  • Q: Will 3rd party forensic imaging applications recognize Tableau forensic bridges?
  • A:

    Yes, Tableau actively works with 3rd party software vendors to facilitate recognition of Tableau forensic bridges in those vendors' forensic imaging applications. Tableau recommends end users contact their preferred forensic software vendors to determine which software releases include Tableau support.

    Tableau forensic bridges must have firmware dates of April 2005, or later to enable full-featured detection by 3rd party software applications.

General Questions About Tableau Forensic Bridges

  • Q: Why are there switches on Tableau bridges?
  • A:

    The switches provide two main functions: 1) Thanks to the switches, Tableau bridges can be field-switched between read-only and read-write operation if so desired by the user, and 2) The switches allow end users to set the bridge's configuration for optimal use with their equipment.

  • Q: Why do Tableau some bridges have two different input power connectors?
  • A:

    When Tableau designed its family of forensic bridges it set out to create the most versatile forensic bridges on the market. In some situations it is more convenient to draw power for the bridge directly from the "Molex" power connector, i.e., the cable/connector from the power supply that was originally supplying power to the subject hard disk. In other situations it is more convenient touse an external AC/DC power adapter.

    Tableau model T3/T3u/T4/T5/T35e forensic bridges support both modes of operation. The "DC In A" connector accepts power from the Tableau TP1 power supply, an external AC/DC adapter. The "DC In B" connector accepts power from the traditional Molex power connector. In either case,Tableau bridges can supply power to the subject hard disk by way of the "DC Out" connector on the Tableau bridge.

    The power switch at the top of the Tableau bridges selects which DC In source is in use at any one time, and also serves as a master ON/OFF switch for both the Tableau bridge and the hard disk connected to the Tableau bridge's DC Out connection.

    Note: Later Tableau bridges (i.e., T8/T9/T35es) have only the "DIN" style power input for use with a Tableau AC/DC power adapter. In these later products the power switch has only "ON" and "OFF" positions.

  • Q: Why is there a black cap covering the DC IN B connector on my Tableau forensic bridge?
  • A:

    Most customers use the TP1 power supply with their Tableau forensic bridges. Recognizing this, Tableau designed the "TM1" cap, a plastic cover for the (often) unused DC IN B power connector. The TM1 cap protects the connector while preventing the user from accidentally touching the exposed pins on the DC IN B connector.

  • Q: Why do Tableau bridges have an LED marked "Write Block"?
  • A:

    Tableau bridges can be switched between read-only and read-write operation at the user's discretion. The "Write Block" LED provides the user with a positive indication that the bridge is configured for read-only (write-blocking) operation when the bridge is being used to capture a forensically sound image from a subject hard disk.

  • Q: Which is faster, FireWire/1394 or USB 2.0?
  • A:

    FireWire (IEEE 1394) is generally faster than USB 2.0 when using Tableau forensic bridges. FireWire400 (1394A) can be 30% to 50% faster than USB 2.0 on a given system and FireWire800 (1394B) is generally faster still, all other things being equal.

  • Q: I see products from other companies that look identical to Tableau's products. Are they the same?
  • A:

    Tableau sells its forensic bridges under the Tableau brand and through certain private-labeling arrangements. Private-label products manufactured by Tableau have the "Powered By Tableau" mark. Tableau is the original equipment manufacturer; Tableau designs and manufactures all Tableau forensic bridges, whether sold under the Tableau brand or as privately labeled products.

  • Q: How should I configure the drive select jumper on an IDE drive to work properly with a Tableau IDE bridge?
  • A:

    An IDE hard drive needs to be configured as Master or Single (depending on the drive manufacturer) to work properly with Tableau IDE bridges. Refer to the label on the drive or the drive manufacturer's website for specific jumper instructions.

T3/T3u and T15 SATA Bridges

  • Q: I see documentation for "internal switches" in the Tableau forensic bridges, but I don't know where these switches are on my T3 SATA bridge. Where are they?
  • A:

    To locate the internal switches on the original T3 SATA bridge you will need to open the T3's plastic enclosure. Remove the four screws on the underside of the case and open the case. The internal switches will be visible once you open the case.

    DO NOT modify the settings of other jumpers on the T3 SATA bridge. As soon as you have made the desired changes to the internal switches, re-close the T3's plastic enclosure before using the T3.

    It is NOT necessary to open the plastic case to reach the switches on the T3u SATA, T4 SCSI, and T5 IDE forensic bridges. On these products the switches may be accessed from the outside by removing the plastic knock-out panel on the bottom edge of the bridge.

  • Q: The T3 SATA bridge doesn't support USB and doesn't have a knock-out panel to access the internal switches. Why is the T3 different from the T4 and T5?
  • A:

    The T3 SATA bridge was the first forensic bridge designed by Tableau. Early customers gave Tableau valuable feedback regarding the T3 and Tableau incorporated that feedback in later designs, including the T3u SATA bridge, T4 SCSI bridge, and the T5 IDE bridge.

  • Q: Is Tableau planning to introduce an upgraded version of the T3 SATA bridge which supports USB and has a knock-out panel to access the internal switches?
  • A:

    Yes. Tableau introduced the T3u SATA bridge. The T3u is an upgraded version of the original T3 SATA bridge. The T3u adds support for USB 2.0 and adds an external knock-out panel to access the configuration switches.

  • Q: How does the T15 compare to the T3u?
  • A:

    The T15 FireWire800 SATA bridge is an ultra-compact forensic bridge for use with SATA hard disks. To make the T15 as small as possible, Tableau removed several features found in the T3u. Namely, the T15 lacks a USB host interface, power switch, dual power supply options, host detect, and drive detect LEDs.

    Even though the T15 has fewer features that the T3u SATA bridge, the T15 achieves imaging times comparable to the T3u and retains key T3u features such as the write block, activity, and power LEDs and configuration switches. Moreover, the T15 connects directly to the back of the SATA hard disk, eliminating the need for a SATA signal cable. And, if the SATA hard disk has a SATA-style 15-pin power connector, the T15 powers the hard disk directly, further eliminating the need for a power jumper cable.

  • Q: Can I use the "legacy" power connector on a SATA hard disk when using the T15?
  • A:

    If the SATA hard disk has both a SATA-style 15-pin power connector and an older 4-pin "Molex-style" legacy power connector, you must not apply power to the 4-pin "Molex-style" power connector when using the T15. The T15 provides power to the hard disk through the SATA-style 15-pin power connector. Applying power to both connectors at the same time may seriously damage the SATA hard disk, the T15, or both.

    If the SATA hard disk has only the older 4-pin "Molex-style" power connector, then it is not possible for the T15 to provide power directly to the hard disk and you must power the hard disk through the 4-pin "Molex-style" connector.

T5 and T14 IDE Bridges

  • Q: Why is my T5 or T14 yellow?
  • A:

    The Tableau T5 and T14 IDE bridges, like all Tableau forensic bridges, can be configured for read-only or read-write operation. Some customers require T5 and T14 units pre-configured for read-write operation. To make these units stand out, so they aren't accidentally confused with write-blocking Tableau forensic bridges, Tableau manufactures these units in yellow cases instead of the standard black cases used on write-blocking units.

  • Q: How does the T14 compare to the T5?
  • A:

    The T14 FireWire800 IDE bridge is an ultra-compact forensic bridge for use with IDE hard disks. To make the T14 as small as possible, Tableau removed several features found in the T5. Namely, the T14 lacks a USB host interface, power switch, dual power supply options, host detect, and drive detect LEDs.

    Even though the T14 has fewer features than the T5 IDE bridge, the T14 achieves imaging times comparable to the T5 and retains key T5 features such as the write block, activity, and power LEDs and configuration switches. Moreover, the T14 connects directly to the back of the IDE hard disk, eliminating the need for an IDE signal cable.

Power and Power Supplies

  • Q: What are the specs for the TP1 power supply?
  • A:

    The Tableau TP1 power supply is an AC/DC adapter. It accepts an input voltage from 100-240VAC and provides regulated outputs at +5VDC and +12VDC.

  • Q: How much power is available for the hard disk when using the TP1?
  • A:

    When you are using the Tableau TP1 to power a Tableau bridge and a hard disk connected to the bridge's DC OUT, you naturally want to know how much power is available for the hard disk.

    As a good rule of thumb, when using the TP1 and a Tableau forensic bridge, the hard disk can draw from 1.0-1.5A @ +5VDC and up to 2.0A @ +12VDC.

    You can generally find a hard disk's current requirements printed on a label on the outside of the hard disk. But be careful! During spin-up, some hard disks have been observed to draw much more than their rated current. So, if the hard disk's stated requirements are close to the recommended TP1 limits provided above you may find the TP1 won't be able to provide enough current for the hard disk to spin up.

  • Q: Can the TP1 power any hard disk?
  • A:

    No, the TP1 may not be able to provide enough power for some hard disks. In particular, Tableau has found that some older, 5.25" full height SCSI hard disks draw too much power during spin-up and cannot be powered by the TP1. In these cases, Tableau recommends you power the hard disk from its existing power supply and use the TP1 to power the Tableau bridge separately.

  • Q: Does a Tableau bridge provide FireWire/1394 Bus Power?
  • A:

    Yes and no.

    The Tableau T3/T3u/T4/T5/T10 bridges feed FireWire (1394) bus power from +12VDC. Tableau bridges incorporate a 1-1.5A current limit and a protection diode to ensure that current flows only from the Tableau bridge's +12VDC supply to the FireWire bus power signal.

    The Tableau T14 and T15 bridges do not provide FireWire (1394) bus power.

    All Tableau bridges with more than one FireWire (1394) connector (that includes the T3/T3u/T4/T5/T10/T14/T15) repeat FireWire bus power. That is, if FireWire bus power is present on one of the Tableau bridge's FireWire800 or FireWire400 ports, that power will be repeated to the other FireWire800 and FireWire400 ports on the Tableau bridge.

  • Q: Can Tableau bridges be powered by FireWire or USB bus power?
  • A:

    No, Tableau bridges cannot be powered by FireWire/1394 bus power or by power from a USB cable.

  • Q: When I attach a Tableau forensic bridge to my computer via FireWire, I hear the fans running in my computer even though the computer is turned off. What is happening?
  • A:

    There is a power wire in standard 6- and 9-pin FireWire cables, and many FireWire devices (including FireWire host adapters and Tableau forensic bridges) are designed to provide power to this wire. In each device which provides power to a FireWire cable there is circuity to prevent power from flowing from the cable back into the device. This circuity usually includes an electrical component called a diode. Tableau has found that some FireWire host adapters are mis-manufactured, and the diode in these FireWire host adapters is backwards. When this happens, power can flow from the Tableau forensic bridge into the host computer through the FireWire host adapter. Unless you are very good with a soldering iron, the only solution is to use a different FireWire host adapter which is properly manufactured. This is not a defect in the Tableau forensic bridge.

Questions Specific to Microsoft Windows

  • Q: Why is my T35u or T35689iu not recognized by Windows 8?
  • A:

    We have identified a problem with the method USB 3 controllers on Windows 8 uses to identify the T35u and T35689iu over USB 3.0. This problem occurs with T35u units with a firmware version earlier than Apr 02, 2013 (TFU 7.03) and T35689iu units with a firmware version earlier than May 22, 2013 (TFU 7.04).

    If you connect a T35u or T35689iu (with an above-mentioned firmware version) to a computer running Windows 8 using a USB 3.0 controller, Windows 8 will incorrectly identify and record the unit as nonfunctioning. Windows 8 maintains a record of this device using a unique identifier and will prevent further proper detection and communication with this specific device, even after it's updated to a later firmware version using another system.

    To prevent this issue from occurring, please use a system with Windows 7 or earlier (Windows 7 or XP is recommended) to update your T35u units to TFU 7.03 or later and T35689iu units to TFU 7.04 or later. These firmware versions include a workaround to allow Windows 8 to properly identify these devices the first time they are connected.

    We are currently working on developing a workaround or patch to restore Windows 8 identification of the specific units connected with older firmware. Please stay tuned to our website for updates on this issue.

  • Q: Will Tableau forensic bridges work with Windows 7?
  • A:

    Yes. Windows 7 will recognize and mount devices connected to Tableau forensic bridges. However, there is a known compatibility issue using Tableau Firmware Update (TFU) with the native Windows 7 1394 bus driver, which was fixed in TFU version 6.61.

    The following workaround will allow versions of TFU prior to v6.61 to work properly over FireWire under Windows 7:

    • Navigate to the Windows 7 Device Manager and click on the "plus" icon next to "IEEE Bus host controllers."
    • Right-click the IEEE 1394 Host Controller and select "Properties."
    • Click the "Drivers" tab and select "Update Driver."
    • Select "Browse my computer for driver software."
    • Select "Let me pick from a list of device drivers on my computer."
    • In the selection screen, choose "1394 OHCI compliant host controller (Legacy)" and click "Next."
    • The legacy driver will install and your Tableau utilities will now communicate properly over FireWire.

  • Q: Will I always be able to mount (see) logical drives on write-blocked Tableau forensic bridges?
  • A:

    The short answer: In most cases, yes, you can see the logical volumes. But in some cases an operating system like Windows XP will not mount the logical drives on a hard disk connected to a Tableau forensic bridge. However, even in these cases you will still be able to access the hard disk on a physical level and extract a forensically sound image using standard forensic imaging software.

    By way of explanation, some operating systems, notably certain versions of Microsoft Windows (e.g., Win XP) will not mount a logical volume unless they can write to the drive on which the volume is located. Tableau forensic bridges in write-blocking mode will not permit writes to a drive, and any writes attempted by such operating systems will be blocked.

    For example, hard disks originally formatted/partitioned under Windows 98 do not have an "NT Drive Serial Number" in the MBR (Master Boot Record, sector 0, offsets 0x1b8-0x1bb). Before mounting the logical drives on such a hard disk, Windows XP attempts to write a non-0 serial number into the MBR. If it can both write the serial number and read it back, then Windows XP will mount the logical volumes the hard disk. If not, Windows will still create a physical device (i.e., "\\.\PhysicalDiskX") for the hard disk.

    It is interesting to note that other OS's, like Linux and Mac OS X, will mount the logical volumes on the same drives without difficulty when using Tableau forensic bridges.

    For those who are curious, it is technically feasible to fool Windows into thinking that the write to the Master Boot Record has succeeded by keeping the data written to the MBR in the memory of the forensic bridge and then returning that data on subsequent MBR reads (a competing forensic bridge vendor has implemented just such a scheme). However, Tableau does not believe this is wise solution. Without absolute knowledge of the algorithms used by each forensic imaging software (and each version thereof), it is possible that the "cached" MBR data could become part of a forensic image or hash calculation, thus casting doubt on the credibility of the forensic image.

Questions Specific to Linux

  • Q: I'm using Linux Kernel 2.6.17 or earlier and the Tableau bridge isn't working when I connect it to the computer via the 6-pin (FireWire 400/1394A) connector. What's wrong?
  • A:

    If your computer has a 1394B (FireWire 800) host adapter, then older Linux kernel releases will try to communicate at FireWire 800 speed even when 6-pin FireWire 400 cabling is used.

    To avoid this problem, either use only 9-pin FireWire 800 cabling or switch to Linux kernel 2.6.18 or newer. These kernel releases are capable of downgrading to FireWire 400 speed when using 6-pin cables.

Cabling

  • Q: I'm using Windows and I have a 1394B host adapter. When I connect this host adapter to the 6-pin (FireWire400/1394A) connector on my Tableau bridge, Windows doesn't recognize the bridge. What's wrong?
  • A:

    Microsoft's official position is that they do not yet support 1394B. So, even though 1394B works correctly in most situations with Windows, not everything works perfectly.

    This is an example of one of these problems. When you have two 1394B-capable devices, in this case the 1394B host adapter and the Tableau bridge, Windows doesn't pay attention to the fact that those devices may be connected over a 1394A link (i.e., the 6-pin connector on the Tableau bridge). Windows therefore tries to send "S800" (800Mbit/sec) packets over the "S400" (400Mbit/sec) connection, and that doesn't work.

    To avoid this problem, always use a 9-pin 1394B-to-1394B cable to connect a 1394B host adapter to one of the FireWire800/1394B ports on the Tableau bridge. This will always work correctly.

  • Q: When I connect two Tableau bridges to my computer at the same time on the same FireWire bus, sometimes Windows doesn't see one or both of the bridges. What's wrong?
  • A:

    Tableau bridges with firmware date codes before Mar 25 2004 have a firmware bug which sometimes prevents the bridges from being recognized properly when connected to fast Windows PCs (e.g., PCs faster than about2.8GHz), and this problem is most often witnessed when attempting to daisy-chain two or more Tableau bridges on the same FireWire/1394 bus.

    To fix this problem, use the Tableau Firmware Update to update the firmware in your Tableau bridges.

  • Q: When I connect two Tableau bridges to my computer at the same time via USB, they don't seem to work correctly. What's wrong?
  • A:

    Tableau bridges with firmware date codes before February, 2005 have a firmware bug which causes problems when you connect two or more Tableau bridges to a computer at the same time using USB.

    To fix this problem, use the Tableau Firmware Update to update the firmware in your Tableau bridges. This problem is fixed in Tableau firmware with date codes of February, 2005 and later.

  • Q: I'm using a USB connector on the front of my computer and my computer is not seeing the Tableau forensic bridge. When I use a USB connector on the back of my computer everything is OK. What's wrong?
  • A:

    Believe it or not, most computers which have a USB connector on the front of the computer are actually violating the USB specification. This is true even of computers from a number of "name brand" PC vendors. The USB specification does not allow cable extenders, and the USB connectors on the front of most computers are fed by just such a cable extender.

    USB cable extenders degrade USB signal quality. When using a high-performance interface like USB 2.0, this signal degradation can cause the USB interface to malfunction. If you must use the USB connector on the front of your computer, use only high quality USB 2.0 cables to connect your computer to the Tableau forensic bridge.

    NOTE: Some vendors now offer USB hubs which can be mounted in the front of a computer and which provide external USB connectors which are accessible from the front of the computer. These hubs regenerate the USB signals and do not violate the USB specification.

  • Q: I already have an IDE, SATA, or SCSI cable. Can I use these cables instead of the IDE, SATA, or SCSI cables sold by Tableau?
  • A:

    Tableau encourages you to use Tableau IDE, SATA, and SCSI cables when using Tableau forensic bridges. Tableau tests its forensic bridges with its own cables, and these cables are known to work reliably with Tableau's forensic bridges.

    SCSI, in particular, offers many different cabling alternatives and levels of quality. For this reason, Tableau strongly encourages customers to use Tableau's TC10-8 SCSI cable when using the T4 SCSI bridge.

TMSS Modular Storage System

  • Q: I'm using Windows 7 and writing to the MSS is slow. Why?
  • A:

    By default Windows 7 disables disk-level write caching for removable storage devices and this can dramatically reduce write performance. It is possible to change the default disk-level write cache setting in Windows 7:

    1. Use the Device Manager to open the Properties dialog for the MSS, and then select the Policies tab.
    2. Under "Removal policy," select "Better performance."
    3. Under "Write caching policy," check "Enable write caching on the device."
    Note: The default behavior for the MSS is to enable its disk-level write cache for improved performance. Older versions of Windows, e.g., Windows XP, do not override this setting.

  • Q: How do I know if I have a bad hard disk?
  • A:

    Tableau MSS products indicate bad (or failing) hard disks in several different ways. If a hard disk is bad or failing, the "Alert" LED on the front of the MSS unit will blink. When this happens, connect your MSS unit to a Windows-based computer and run the Tableau Storage Manager (TSM) application. TSM will interrogate the MSS unit and display detailed status indicating the nature of the problem. If you have a bad or failing hard disk, TSM will identify the faulty drive.

  • Q: How do I replace a hard disk?
  • A:

    The MSS Users' Guide provides complete instructions for installing or replacing hard disks in an MSS product.

  • Q: What does it mean when the yellow Alert LED is blinking on my MSS unit?
  • A:

    The Alert LED will blink any time the MSS unit requires user attention or intervention. Use the TSM application to retrieve detailed status from the unit.

  • Q: My MSS unit appears to mount correctly, but I only see a FAT32 partition with a single "README.TXT" file in the root directory. Where is my data?
  • A:

    Tableau MSS units have a unique diagnostic capability. When the MSS unit is unable to initialize an operable (or degraded) array, the MSS unit creates a "phantom" disk image with a single README.TXT file. The README.TXT file contains the full operating status of the array and can be viewed with any text editor. This unique feature makes it possible for you to diagnose an MSS unit without the need to run the TSM application. This is especially useful when using MSS units on a non-Windows platform like OS X or Linux.

  • Q: Can I use any type of hard disk in MSS?
  • A:

    MSS supports 3.5" SATA hard disks with the "unitized" SATA signal & power connector. MSS is designed to supply up to 1A continuous current on each of the +5VDC and +12VDC power lines for each hard disk (up to 4A total continuous current on each voltage when four drives are in use). MSS is designed to supply up to 2A spin-up current on each of the +5VDC and +12VDC power lines. MSS sequences the spin-up of each drive, and this ensures that only one drive is drawing spin-up current at any one time. MSS does not provide +3.3VDC to the hard disks. These ratings are summarized in the following table:

    MSS Hard Disk Current Ratings
    +3.3V DC+5V DC+12V DC
    Continuous Operation
    Each Driven/a1A1A
    Four Drives (total)n/a4A4A
    Spin-Up
    Each Driven/a2A2A
    Four Drives (total)n/an/an/a

  • Q: Do I need to use four identical hard drives in MSS?
  • A:

    No, you do not need to select four identical hard drives when building an MSS unit. However, you should probably use drives which are similar in capacity as the size of the array will be determined by the smallest of the drives installed. For example, if you install one 1TB drive and 3 1.5TB drives, the MSS controller will use only the first 1TB of each drive when building the array.

    Theoretically there is an advantage in using different makes/models of hard drives when building a fault-tolerant array like MSS. If you use identical drives, then it is possible that the drives may have a common design or manufacturing fault. If that is the case, then it is possible that two or more drives may fail at a similar rate. While MSS can handle the failure of any one drive, it cannot recover from the simultaneous failure of two or more drives. Using different makes/models of hard drives when building an array reduces the likelihood that two or more drives will fail at about the same time.

  • Q: How do I determine the effective capacity of an MSS unit?
  • A:

    MSS uses a "RAID 5" configuration for fault tolerance. This means that the capacity of the array is one drive less than the number of drives installed. So, if you put four drives of identical capacity in the MSS unit, then the effective capacity is that of three drives. Additionally, the MSS controller is limited to using the capacity of the smallest drive in the array. So, if the drives in a given MSS unit vary in size, the effective capacity will be three times that of the smallest drive in the unit.

    The TSM application can display capacity information for each drive and for the full array.

  • Q: My effective capacity should be xxTB, but I'm only seeing 2TB. Why?
  • A:

    Some host computers and devices do not work correctly with disks larger than 2TB. In fact, some older hosts will corrupt the data on a device larger than 2TB. To give you maximum flexibility when dealing with older hosts, Tableau MSS units can be configured/initialized at full capacity or at a capacity which is artificially limited to 2TB, or a multiple thereof.

    For further information on this topic, please refer to the section of the TMSS User's Guide titled "Initializing Very Large RAID Sets".

  • Q: What hosts are limited to 2TB?
  • A:

    This is a hard question to answer completely. Generally, older 32-bit operating systems like Windows XP will not handle drives with more than 2^32 - 1 sectors, or the biggest sector number that can be represented in 32 bits (roughly 4 billion sectors). When using 512 byte sectors this results in a 2TB drive-size limit. For a variety of technical and compatibility reasons, Tableau MSS units will only use 512 byte sectors. So, any operating system or driver which handles only 32-bit sector numbers will be subject to the 2TB limit.

    Even if you are using a modern operating system, certain device drivers from independent hardware manufacturers (e.g., some eSATA add-in card manufacturers) won't correctly handle sector number larger than 32-bits. We recommend you specifically check to make sure your operating system and device drivers correctly handle drives larger than 2TB.

    For further information on this topic, please refer to the section of the TMSS User's Guide titled "Initializing Very Large RAID Sets".

  • Q: I'm using eSATA to connect the MSS unit to the host computer, but I'm not seeing the drive? Everything seems fine when I use FireWire/1394 or USB. What's wrong?
  • A:

    Some eSATA (and SATA) interfaces and drivers do not handle hot-swapping very well. If you have an eSATA interface/driver which does not automatically recognize your MSS unit, you may need to force the host operating system to re-detect devices.

  • Q: Can I change the RAID configuration?
  • A:

    No, MSS is specifically designed to use a RAID 5 configuration for fault tolerance and this cannot be changed by the user.

  • Q: May I use/install fewer than four drives in the MSS unit?
  • A:

    No, you must install a full complement of four drives in each MSS unit.

  • Q: What happens when a drive fails? Can I still read and write to the MSS unit?
  • A:

    Yes. When one of the four drives fails the MSS unit enters a "degraded" mode of operation. You will still be able to read and write data on the unit, but performance will be significantly reduced. Additionally, the longer you run a unit in the degraded mode the higher your chances of a second drive failure. If a second drive fails before you replace the first drive (and initiate a RAID re-build), then you will permanently lose access to information stored on the MSS unit.

  • Q: I'm using a Tableau TD1 duplicator. Will it work with MSS?
  • A:

    Yes, the Tableau TD1 duplicator will work with MSS. However, as of this writing the TD1 can only use the first 2TB of the MSS unit. Future Tableau brand duplicators will be able to use MSS units with more than 2TB of effective capacity.

  • Q: Can MSS units be updated in the field?
  • A:

    Yes, Tableau MSS units are fully supported by the Tableau Firmware Update (TFU) utility. You will be able to use TFU to update the firmware in MSS units in the field as new versions of firmware are released.

    Note: TFU uses the FireWire/1394 connection on the MSS units to apply firmware updates. You will need a FireWire/1394 connection and a Windows-based PC to apply firmware updates to MSS units in the field.

  • Q: Do MSS products have a power save or sleep mode?
  • A:

    Yes. Tableau MSS products will spin-down when so requested by the host operating system.

    Note: As of this writing the MSS units do not turn off the cooling fans when spinning down. Dynamic fan speed control and power-down will be enabled in a future firmware release.

  • Q: How do I turn OFF the MSS unit?
  • A:

    Press and hold the power button on the front of the MSS unit for one second to turn the unit OFF.

    Note: When turning the MSS unit ON, you do not need to hold the power button. A brief touch of the power button is sufficient to turn the unit ON.

  • Q: You've mentioned the Tableau Storage Manager (TSM) application many times. Where can I get it?
  • A:

    The TSM application is a free download from the Tableau web site. Please visit the product page for TSM at http://www.encase.com/tsm.

  • Q: Can I print my own evidence tags?
  • A:

    Yes, a standard 3x5" index card will fit in the evidence tag slot on the front of the MSS unit. We provide a Microsoft Word template compatible with Avery 5388 white index cards so you can print your own evidence tags.

  • Q: Can I encrypt the contents of the MSS unit?
  • A:

    Tableau MSS units are designed with encryption hardware. However, as of this writing the firmware does not yet enable the encryption capability.

We're Here to Help

Product Questions & Sales
Contact a reseller
email us: tableau@guidancesoftware.com

Technical Support
Contact a reseller
email us: support@guidancesoftware.com
call us: (626) 229-9191, Option 4