CUSTOM-BUILT FOR DIGITAL INVESTIGATIONS

In the lab, or in the field, the NEW Tableau Forensic Imager (TX1) acquires more data, faster, from more media types, without ever sacrificing ease-of-use or portability.

Successor to the Tableau TD3 and redesigned from the circuit board up, the TX1 is built on a custom Linux kernel, making it lean and powerful. Every component is hand-selected and tested to guarantee reliability and performance when conducting forensic imaging operations.

TX1-S1 DRIVE BAY

• Adds two additional cable-less SATA/SAS destination drive connections to the TX1
• Compatible with 2.5” and 3.5” SATA/SAS drives
• Internal fan provides drive cooling
• Easy modular connection – Just slide to connect/disconnect from the TX1
• Included in the TX1 Kit!

SUPPORT UP TO FOUR DESTINATIONS PER SOURCE

With the Drive Bay connected, the TX1 can output to four SATA/SAS, one USB 3.0 and one or more network shares. TX1 supports up to four destinations per source (1:4) with the ability to combine clone/image duplication and local/network destinations. Flexibility and power that save users’ time! 

10 GbE NETWORK CONNECTION

Featuring the industry’s first 10 GbE network connection, the TX1 provides superior network imaging performance. TX1 supports an iSCSI target as a source or destination and a CIFS share as a destination.

TIP: Combine a Tableau TX1 with a portable Network Attached Storage (NAS) solution that supports 10 GbE to improve your forensic imaging workflow by acquiring all suspect media to the NAS through the TX1’s network port. No need for bare drives!

BEAUTIFUL AND INTUITIVE USER INTERFACE

The TX1 features a tablet-sized (7”) color touch-screen display with navigation menus and features that resemble modern smartphones: 

• Home tab enables quick operations in just two touches: (Duplicate, Verify, Hash and Browse)
• Jobs tab provides summary and details of active, queued and completed jobs
• SideNav gives access to Logs, System Settings, Network Settings and Imaging Defaults
• Pinch and Zoom
• Sensible Defaults
• On-screen warnings within various settings and operations screens
• Intelligent preconditions and rules to protect the user by disabling destructive operations on drives in use

SIMULTANEOUS IMAGING

The TX1 can support two concurrent forensic jobs without sacrificing performance. A forensic job is anything that involves creating a hash: Duplicating (imaging or cloning), Hashing & Verifying. Automatic job queuing allows additional jobs to begin as soon as an active job completes – A convenience for users, to get them through their backlog faster.

MEDIA UTILITY OPTIONS

In addition to forensic jobs that involve hashing, the TX1 can also simultaneously complete other media operations that do not involve hashing. Even while two forensic jobs are running, you can use the remaining available TX1 port(s) to perform any number of these media operations:

• View drive details • Wipe • Format • Blank Check • View & disable HPA/DCO
• AES whole disk encryption • View S.M.A.R.T. • Eject media

UNMATCHED PERFORMANCE

The TX1 performs favorably when evaluated against other available products, especially when comparing data transfer rates of forensic jobs that include two hash values: MD5, SHA-1 or SHA-256. However, when we think of performance, we think past just MB/second. Performance means efficiency – Completing the task or workload with minimal time, effort, and training.

Every component, design decision, and feature of the TX1 was included to improve efficiency, in the lab or in the field. From the intuitive user interface to broad media support, simultaneous imaging, 10 GbE, and more, TX1 will save time and resources.

LOGICAL IMAGING AND SEARCH

The TX1 acquires forensically-sound, logical images from locally attached drives and network shares. Provides the ability to image the entire filesystem, manually select specific folders and files or use the powerful Files to Acquire screen to define a targeted search profile using pre-defined and custom criteria.

Logical image searches can also be saved to the TX1 allowing a user to create, name, and store complicated or commonly used searches for future use, saving time and improving efficiency.

TX1 also comes with the ability to export and import logical image searches which significantly improves efficiency and user experience during logical acquisitions. Users can also leverage wildcard characters in search criteria for logical images.

SECURE DEVICE ACCESS VIA LOCK SCREEN WITH PIN CODE

A user can lock the TX1 screen with a temporary PIN code to secure the unit while unattended. A message at the top of the lock screen indicates the date and time the unit was locked.

DRIVE DETECTION WITH WHOLE DISK ENCRYPTION

The TX1 Automatically detects drives encrypted with the following whole disk encryption types: BitLocker, BitLocker To Go, FileVault 2, Linux® Unified Key Setup, Jetico® BestCrypt™ and Symantec PGP Disk.

COMPREHENSIVE APPLE TARGET DISK MODE FORENSICS

The TX1 offers several methods to acquire digital evidence from Mac computers in Target Disk Mode over USB-C, FireWire or Thunderbolt (with Apple’s FireWire to Thunderbolt adapter). Captures both physical drives (HDD and SSD) configured as one Fusion Drive on iMac® and Mac Mini®

REMOTE WEB INTERFACE

Any network connected TX1 can be remotely accessed using a web browser from any device on the same network.

PAUSE AND RESUME IMAGING JOBS

For the first time in the forensic industry, users can pause any running imaging job (E01, Ex01, DD, DMG) and resume later, even across power-cycles. This increases efficiency by saving time in a variety of scenarios that previously required the job to be restarted.

VIEW IMAGE AND PLAIN TEXT FILES

Text and image files can be viewed directly on TX1 from the Browse window to quickly triage and determine the priority or relevance to the investigation.

MULTI USER ACCESS

Users can now create, delete and manage multi-user profiles, resulting in an improved user experience. This allows users to uniformly deploy common pre-selected settings, as well as personalize or customize individual settings.

ADDITIONAL FEATURES

• Whole-disk, open-standard, destination drive encryption using AES-XTS
• Two USB 3.0 Accessory ports for connecting an external keyboard or exporting logs
• HPA and DCO support for the detection and handling of hidden/protected data areas on source drives, optional trim support for the creation of a destination DCO
• Visual display of drive utilization of physical drive and file systems
• Optional multicolour LED and alert sounds for notifications
• Detailed forensic logs for case documentation
• S.M.A.R.T. verification
• Extensive drive detail