CUSTOM-BUILT FOR DIGITAL INVESTIGATIONS
In the lab, or in the field, the NEW Tableau Forensic Imager (TX1) acquires more data, faster, from more media types, without ever sacrificing ease-of-use or portability.
Successor to the Tableau TD3 and redesigned from the circuit board up, the TX1 is built on a custom Linux kernel, making it lean and powerful. Every component is hand-selected and tested to guarantee reliability and performance when conducting forensic imaging operations.
BROAD MEDIA SUPPORT
The TX1 can forensically image a broad range of media, including PCIe and 10Gb Ethernet devices, and supports up to two active forensic jobs at a time (simultaneous imaging). When imaging, TX1 outputs to raw .DD and .dmg formats, .e01 (compressed), or .ex01 (compressed), and features extensive file system support (ExFAT, NTFS, EXT4, FAT32, HFS+).
TX1-S1 DRIVE BAY
SUPPORT UP TO FOUR DESTINATIONS PER SOURCE
With the Drive Bay connected, the TX1 can output to four SATA/SAS, one USB 3.0 and one or more network shares. TX1 supports up to four destinations per source (1:4) with the ability to combine clone/image duplication and local/network destinations. Flexibility and power that save users’ time!
10 GbE NETWORK CONNECTION
Featuring the industry’s first 10 GbE network connection, the TX1 provides superior network imaging performance. TX1 supports an iSCSI target as a source or destination and a CIFS share as a destination.
TIP: Combine a Tableau TX1 with a portable Network Attached Storage (NAS) solution that supports 10 GbE to improve your forensic imaging workflow by acquiring all suspect media to the NAS through the TX1’s network port. No need for bare drives!
BEAUTIFUL AND INTUITIVE USER INTERFACE
The TX1 features a tablet-sized (7”) color touch-screen display with navigation menus and features that resemble modern smartphones:
The TX1 can support two concurrent forensic jobs without sacrificing performance. A forensic job is anything that involves creating a hash: Duplicating (imaging or cloning), Hashing & Verifying. Automatic job queuing allows additional jobs to begin as soon as an active job completes – A convenience for users, to get them through their backlog faster.
MEDIA UTILITY OPTIONS
In addition to forensic jobs that involve hashing, the TX1 can also simultaneously complete other media operations that do not involve hashing. Even while two forensic jobs are running, you can use the remaining available TX1 port(s) to perform any number of these media operations:
• View drive details • Wipe • Format • Blank Check • View & disable HPA/DCO
• AES whole disk encryption • View S.M.A.R.T. • Eject media
The TX1 performs favorably when evaluated against other available products, especially when comparing data transfer rates of forensic jobs that include two hash values: MD5, SHA-1 or SHA-256. However, when we think of performance, we think past just MB/second. Performance means efficiency – Completing the task or workload with minimal time, effort, and training.
Every component, design decision, and feature of the TX1 was included to improve efficiency, in the lab or in the field. From the intuitive user interface, to broad media support, simultaneous imaging, 10 GbE, and more, TX1 will save time and resources.
LOGICAL IMAGING AND SEARCH
The TX1 acquires forensically-sound, logical images from locally attached drives and network shares. Provides the ability to image the entire filesystem, manually select specific folders and files or use the powerful Files to Acquire screen to define a targeted search profile using pre-defined and custom criteria.
Logical image searches can also be saved to the TX1 allowing a user to create, name, and store complicated or commonly used searches for future use, saving time and improving efficiency.
TX1 also comes with the ability to export and import logical image searches which significantly improves efficiency and user experience during logical acquisitions. Users can also leverage wildcard characters in search criteria for logical images.
SECURE DEVICE ACCESS VIA LOCK SCREEN WITH PIN CODE
A user can lock the TX1 screen with a temporary PIN code to secure the unit while unattended. A message at the top of the lock screen indicates the date and time the unit was locked.
DRIVE DETECTION WITH WHOLE DISK ENCRYPTION
The TX1 Automatically detects drives encrypted with the following whole disk encryption types: BitLocker, BitLocker To Go, FileVault 2, Linux® Unified Key Setup, Jetico® BestCrypt™ and Symantec PGP Disk.
COMPREHENSIVE APPLE TARGET DISK MODE FORENSICS
The TX1 offers several methods to acquire digital evidence from Mac computers in Target Disk Mode over USB-C, FireWire or Thunderbolt (with Apple’s FireWire to Thunderbolt adapter). Captures both physical drives (HDD and SSD) configured as one Fusion Drive on iMac® and Mac Mini®
REMOTE WEB INTERFACE
Any network connected TX1 can be remotely accessed using a web browser from any device on the same network.
See the TX1 3.0 User Guide for instructions on setting up a TX1 for remote access.
PAUSE AND RESUME IMAGING JOBS
For the first time in the forensic industry, users can pause any running imaging job (E01, Ex01, DD, DMG) and resume later, even across power-cycles. This increases efficiency by saving time in a variety of scenarios that previously required the job to be restarted.
VIEW IMAGE AND PLAIN TEXT FILES
Text and image files can be viewed directly on TX1 from the Browse window to quickly triage and determine the priority or relevance to the investigation.
MULTI USER ACCESS
Users can now create, delete and manage multi-user profiles, resulting in an improved user experience. This allows users to uniformly deploy common pre-selected settings, as well as personalize or customize individual settings.