OpenText™ is excited to announce the release of the new Logical Imaging feature for the Tableau Forensic Imager TX1 2.0. This major release is available in Tableau Firmware Update version 7.25. The Tableau TX1 is a powerful and intuitive forensic imager that offers superior local and networked imaging performance with no compromises. The latest version is now packed with new features, enhancements and fixed issues to address evolving challenges in forensic data acquisitions, while improving performance and usability.
Logical imaging and search
Users can now acquire forensically-sound logical images from locally attached drives and network shares. Further, users can image the entire filesystem, manually select specific folders and files, or use the powerful Files to Acquire screen to define a targeted search profile using pre-defined and custom criteria. The Files to Acquire search function provides a basic (default) and advanced mode, which can be easily enabled and disabled in the default settings screen. This tool saves valuable time by focusing on specific files of interest rather than acquiring the entire physical drive. TX1 logical imaging understands the structure of the recognized filesystem and acquires the desired source file data and/or metadata.
Detect drives with whole disk encryption
TX1 automatically detects drives encrypted with the following whole disk encryption types: Microsoft BitLocker & BitLocker To Go, Apple FileVault 2, Linux LUKS, BestCrypt, and Symantec PGP Disk. When TX1 detects an encrypted drive, it displays an information message indicating the encryption type on the drive tile summary and the drive detail screen. The encryption type is also reported in the forensic log.
Detect Apple Fusion drives on Apple Macs
TX1 detects and presents both physical drives (HDD and SSD) configured as one Fusion Drive on Apple Macs connected to TX1 in Target Disk Mode. Fusion Drives are configured on some Apple iMacs and Mac Minis.
Display more USB device descriptors
USB descriptors, including Class, SubClass, Protocol, VID (Vendor ID) and PID (Produt ID) are now displayed in the USB device media detail screen and reported in the forensic log.
Logical imaging in action!
TX1 Logical Imaging enables users to save valuable time and destination drive capacity requirements by focusing on specific files of interest rather than acquiring the entire physical drive.
Resources and downloads
Looking to update your TX1 units? You can download this release and the view the Release Notes here, or download the updated TX1 2.0 User Guide here to learn how to use the new features included in this release.
New to Tableau? Learn more and set up a demo session with us here.
