TD3 supports collecting data in a forensically sound (a.k.a. "write-blocked") manner. SATA, USB 3.0, USB 2.0/1.1, and FireWire devices connect directly to TD3 using the appropriate port. IDE and SAS devices can be imaged thru TDPX5 (IDE) and TDPX6 (SAS) expansion modules. The FireWire write blocker on TD3 allows for convenient imaging of Mac™ systems booted in "target disk mode" - without the hassle of hard drive removal.
TD3 offers a variety of evidence storage options. New for 2014 is the TDS2 SATA Drive Enclosure. TDS2 supports easy, "tool-less" hard drive insertion and removal. The locking handle on TDS2 enables easy hard drive replacement while also securing hard drives within the enclosure. No need for cable connections when using TDS2. The SATA power and signal connections are made directly between the TD3 and TDS2.
TDS2's are built to support simultaneous imaging to two SATA drives. Simply connect two TDS2's one on top the other to enable "twinning mode".
Many examiners prefer to image directly to bare hard drives. TD3 supports imaging to bare hard drives or to other legacy Tableau Modular Storage Products with the appropriate cables (included in the TD3 kit).
TD3 users can add the flexibility and performance of writing out to USB 3.0 storage devices with the TDPX8-RW USB 3 Expansion Module. When connected to the TD3 expansion port, TDPX8-RW can be selected as an output destination in the TD3 setup parameters. Simply connect your USB 3.0 storage device and go!
For network based forensic acquisitions, remote triage applications, or network based "write blocking", TD3 comes with an integral network connection. New for 2014 is the optional TDPXE Gigabit Ethernet expansion module. This module offers the flexibility of two additional network connections and improved networking performance.
Central to the uniqueness of TD3 is a high-resolution, color touch screen user interface, used to control and monitor ongoing TD3 operations. Designed to be powerful yet simple to use, this wizard driven UI uses simple touch gestures to select and initiate all TD3 functions. To facilitate easy data entry, TD3 includes a pop-up software touch-screen keypad for entering data, reviewing logs, connecting to networks, or completing setup. If a physical keypad is preferred, connect an external keyboard thru the TD3's general purpose USB 2.0 port. With the TD3, we've taken the art of duplicator design to a new level.
There are instances when central command may want or need to preview or collect data from a storage device located thousands of miles away. When used as a network-based write blocker, TD3 supports this. With the appropriate IP address, remote PCs can access TD3's via the internet. Storage devices connected to TD3's write blocked ports are presented as an iSCSI target. In this manner, remote PCs can browse or even collect data from the remote storage device. In many instances, accessing data remotely is more convenient and possibly safer than physically transporting the storage devices.
TD3 is a Synthesis of leading forensic technologies
- Modular device support
- Modular storage
- Network-attached write blocker
- Network-capable duplicator
- Hardware compression for direct .e01, .exO1 file support
- High resolution colour video UI (touch-screen)
- Linux based imaging platform
TDPX Expansion Modules can be easily connected to the Tableau Expansion Connector to image IDE, USB 3.0, SCSI, and SAS storage devices.
TD3 can be 'santized' for transport in and out of secure environments by removing the SD card.
A standard TD3 kit includes:
TD3 Forensic Imager, TDPX5 IDE Protocol Adapter, TDS2 SATA Drive Enclosure (AKA 'Storage Brick'), Tableau Adapter Kit, TP4 Power Supply, All Required Cables.
TD3 supports a variety of destination (output) drive options:
- iSCSI Network Share
- CIFS Network File Share
- TDS1 SATA Enclosure
- TMSS-II01 RAID-5 Enclosure
- TMSS-BIO1/S1 Modular RAID-5
- Bare HDD (with proper cable).
TD3 supports remote write-blocked access to storage media for triage, preliminary investigation, or data collection. Remote users connect thru the GigaBit Ethernet TD3 connection. Devices of interest are write blocked and present themselves as iSCSI targets.