In today’s technology-centric world, more than 80% of the evidence collected in a criminal investigation includes the digital evidence contained on a laptop, computer or mobile device. Considering the average home now contains more than 11 personal digital devices, imagine the challenge faced by investigating agencies when they need access to the information contained on those devices’ hard drives. If a law enforcement or government agency needs to investigate, it is simply not feasible to confiscate a suspect’s device and take it back to the lab for analysis. Labs would be stacked floor to ceiling with suspect devices that investigators would never get the opportunity to analyze.
Digital forensic investigators need the ability to acquire a copy of the information contained on a suspect device to be used as part of their investigation – referred to as a forensic duplicate. This approach saves time, money, real estate and resources during the investigative process. The information obtained from the suspect device must be a bit-by-bit copy and serve as a comprehensive duplicate, providing an image that is a locked snapshot of the information contained on that device and can be used as part of the evidence analysis process.
The Tableau Forensic TD4 Duplicator is the newest member of the OpenTextTM digital investigation suite, designed to provide digital forensic investigators with an easy-to use, cost-effective, reliable, fast and simple process to acquire suspect drive images in a forensically sound manner. Designed for smaller-scale workloads, the Tableau Forensic TD4 Duplicator is a budget-friendly solution that combines reliable forensic imaging, maximized performance and ease of use for stand-alone digital imaging operations. The Tableau Forensic TD4 Duplicator delivers fast forensic acquisitions of common physical media such as PCIe, USB, SATA and SAS, as well as additional forensic and media management operations.
Making imaging operations easy, convenient and fast is at the heart of the Tableau Forensic TD4 Duplication functionality. For example, investigators are able to kick off imaging jobs with a single click. Once job settings have been pre-set, they are retained in memory and future imaging jobs default to those settings.
Tableau Forensic TD4 Duplicator’s on-screen, real-time feedback provides a progress bar with each job, indicating the speed and efficiency of imaging operations, error status, encryption status and warnings. This not only improves the efficiency of the operation but assists less experienced examiners during the imaging operations.
Frequently an investigation involves multiple parties who may need access to the information contained on the suspect drive. The Tableau Forensic TD4 Duplicator delivers the flexibility to simultaneously make multiple copies of that disk. This improves the collaboration and efficiency of the investigative team while ensuring the source drive is quickly returned to its rightful owner or the proper evidence location.
Agencies on tight budgets often re-use destination media between cases in order to minimize the financial impact. As a suspect source drive is imaged and the duplicate image is captured on the destination media, examiners must ensure the destination media has been wiped clean of any other previous case data to ensure the forensic integrity of their evidence. The Tableau Forensic TD4 Duplicator provides both clear and purge disk wipe capabilities, which adhere to the NIST standards, in order to ensure the destination media is pristine and forensically sound.
Improving the efficiency of investigations
Saving time and improving efficiency is key to helping investigators get to the truth faster. While the PCIe serial bus used on computer disk drives has helped usher in advancements in increased capacity drives and video and graphics processing capabilities, time-saving operations such as hot-swappable drives are not optimized with the PCIe bus. However, the Tableau Forensic TD4 Duplicator is the first product in the industry to enable PCIe hot-swap of both source and destination drives, saving examiner time and frustration during the imaging process.
Unlike the Tableau Forensic TX1 Imager, which is designed to provide high-performance simultaneous imaging across the network, the Tableau Forensic TD4 Duplicator is designed for smaller, local imaging jobs, imaging a single source drive at a time and delivers a smaller, more portable form factor. Additionally, because it is designed for a single imaging job at a time, it provides a simplistic, straightforward workflow aimed at delivering ease of use. When compared to its predecessor, the Tableau Forensic TD2u Duplicator, the TD4 provides significant efficiency advantages.
The Tableau Forensic TD4 Duplicator is part of an entire family of Tableau Forensic solutions designed to facilitate digital forensic investigations with imaging, duplication and write-blocking capabilities. Law enforcement, government agencies and corporations around the world have trusted Tableau Forensic as their imaging technology of choice for more than 20 years. As the pioneer in digital forensic investigations, OpenTextTM Tableau Forensic and EnCase digital forensic solutions provide investigators with the information advantage needed to help make the world a safer, more secure place by finding the truth in data. For more information on Tableau Forensic imagers, duplicators, bridges/write blockers and accessories, visit our website.
