Tableau TD2 Users Guide-1

Tableau TD2 Version 4.
01
Users Guide
GUIDANCE SOFTWARE | Tableau TD2 Users Guide

Copyright20092012GuidanceSoftware,Inc.Allrightsreserved.
EnCase,EnScript,FastBloc,GuidanceSoftwareandEnCEareregisteredtrademarksortrademarksownedbyGuidanceSoftware
intheUnitedStatesandotherjurisdictionsandmaynotbeusedwithoutpriorwrittenpermission.Allothermarksandbrandsmaybe
claimedasthepropertyoftheirrespectiveowners.Productsandcorporatenamesappearinginthisworkmayormaynotbe
registeredtrademarksorcopyrightsoftheirrespectivecompanies,andareusedonlyforidentificationorexplanationintothe
owners'benefit,withoutintenttoinfringe.Anyuseandduplicationofthisworkissubjecttothetermsofthelicenseagreement
betweenyouandGuidanceSoftware,Inc.ExceptasstatedinthelicenseagreementorasotherwisepermittedunderSections107or
108ofthe1976UnitedStatesCopyrightAct,nopartofthisworkmaybereproduced,storedinaretrievalsystemortransmittedin
anyformorbyanymeans,electronic,mechanical,photocopying,recording,scanningorotherwise.Productmanualsand
documentationarespecifictothesoftwareversionsforwhichtheyarewritten.Forpreviousoroutdatedversionsofthiswork,please
contactGuidanceSoftware,Inc.athttp://www.guidancesoftware.com.Informationcontainedinthisworkisfurnishedfor
informationaluseonly,andissubjecttochangeatanytimewithoutnotice.

Contents
Preface 3
AboutthisGuide................................................................................................................................................4
ConventionsUsedinthisGuide.........................................................................................................................4
DiskCapacityandTransferRateMeasurementConventions............................................................................4
Overview 1
TableauTD2.......................................................................................................................................................2
TD2KitContents................................................................................................................................................3
NavigatingtheTD2.............................................................................................................................................5
ReadingtheLEDs................................................................................................................................................6
USBKeyboardSupport.......................................................................................................................................6
LCDContrast......................................................................................................................................................6
SettinguptheTD2 9
StartupSequence.............................................................................................................................................10
Initialization.....................................................................................................................................................10
ConfiguringtheTD2.........................................................................................................................................11
UserSelectedStartupMode............................................................................................................................11
Setup(Menu9)................................................................................................................................................11
SystemOptions(Menu9.1)........................................................................................................................12
ImagingOptions(Menu9.2).......................................................................................................................13
TD2Info(Menu9.3)...................................................................................................................................15
FactoryReset(Menu9.4)...........................................................................................................................15
ConnectingHardDisks.....................................................................................................................................16
ConnectingNotebookHardDisks...............................................................................................................17
DriveDetection................................................................................................................................................17
UsingtheTD2 19
Overview..........................................................................................................................................................20
TD2MenusandOptions.............................................................................................................................20
DuplicateDisk(Menu1)...................................................................................................................................22
DisktoDisk/Cloning(Menu1.1)................................................................................................................22
DisktoFile/Imaging(Menu1.2)................................................................................................................24
PreconditionsChecking....................................................................................................................................28
FormatDisk(Menu2)......................................................................................................................................30
FormatDest(Menu2.1).............................................................................................................................30
FormatUSB(Menu2.2)..............................................................................................................................31
WipeDisk(Menu3).........................................................................................................................................32
OnePassWrite(Menu3.1)........................................................................................................................32
MultiPassWrite(Menu3.2)......................................................................................................................32
HashUtilities(Menu4)....................................................................................................................................32
BlankCheck(Menu5)......................................................................................................................................33
DiskInformation(Menu6)...............................................................................................................................33
DiskUtilities(Menu7)......................................................................................................................................34

RemovalofDCOandHPARegions.............................................................................................................34
DestFreeSpace(Menu7.3).......................................................................................................................35
StatusInformation...........................................................................................................................................35
Logs(Menu8)..................................................................................................................................................36
ViewLogs(Menu8.1).................................................................................................................................36
SampleTD2Log..........................................................................................................................................37
SaveAllLogs(Menu8.2)............................................................................................................................39
PrintAllLogs(Menu8.3)............................................................................................................................39
EraseLogs(Menu8.4)................................................................................................................................39
ResettingandClearingInternallyStoredInformation.....................................................................................40
TroubleshootingandSupport 43
TroubleshootingCommonProblems...............................................................................................................44
PowerSupplyIssues...................................................................................................................................44
ProblemswithDiskDetection....................................................................................................................44
ReplacingtheBackupBatteryfortheRealtimeClock..............................................................................45
Support............................................................................................................................................................50
TechnicalSupport.......................................................................................................................................50
OnlineSupport...........................................................................................................................................51
ProfessionalServices..................................................................................................................................55
Training......................................................................................................................................................55
Index................................................................................................................................................................57

InThisChapter

Preface
About this Guide
Conventions Used in this Guide
Disk Capacity and Transfer Rate Measurement Conventions
4 Tableau TD 2 Version 4.01 User's Guide

AboutthisGuide
ThisguidepresentsawiderangeoftechnicalinformationandproceduresforusingtheTD2.Itis
dividedintothefollowingchapters.
Overview:ProvidesgeneralinformationabouttheTD2aswellasunpacking,startingup,and
navigatingtheTD2smenusandLEDs.
SettinguptheTD2:ProvidessystemoverviewinformationabouttheTD2aswellas
proceduresforconfiguringandconnectingtheTD2.
UsingtheTD2:ProvidesdetailedinformationandproceduresforusingtheTD2.
TroubleshootingandSupport:Providesabrieflistofpotentialproblemsandsolutions.For
morecompleteandcurrenttroubleshootinginformationaswellasanswerstofrequently
askedquestions(FAQ),visittheTableauwebsiteatwww.tableau.com.
ConventionsUsedinthisGuide
TheTD2hastwosoftkeysplacedimmediatelyundertheLCDdisplay.ThebottomlineoftheLCD
displaystextindicatingthecurrentfunctionforeachofthetwosoftkeys.Inthisguide,softkeylabels
areindicatedwithsquarebrackets.Forexample,[Select]indicatesthatSelectisdisplayedaboveasoft
keyontheLCD.

DiskCapacityandTransferRateMeasurementConventions
Thecomputerindustrygenerallyadherestotwodifferentconventionsforthedefinitionsoftheterms
megabyte(MB)andgigabyte(GB).ForcomputerRAM,1MBisdefinedas2
20
=1,048,576bytesand1
GBisdefinedas2
30
=1,073,741,824bytes.Fordiskstorage,1MBisdefinedas10
6
=1,000,000bytesand
1GBisdefinedas10
9
=1,000,000,000bytes.Thesetwoconventionsareknownaspowersoftwoand
powersoftenrespectively.Microsoftdeviatesfromtheharddiskcapacitymeasurementconvention
andusesthepowersoftwoconventionforitsoperatingsystems.
Tableaureportsdiskcapacitiesandtransferratesaccordingtotheindustrystandardpowersoften
convention.InTD2screens,reports,anddocumentation,a4GBharddiskstoresupto4,000,000,000
bytes;aharddiskwitha150MB/sectransferratetransfers150,000,000bytespersecond.

InThisChapter
Tableau TD2
TD2 Kit Contents
Navigating the TD2
Reading the LEDs
USB Keyboard Support
LCD Contrast

Chapter 1
Overview

TableauTD2
TheTableauTD2isaforensic1:2duplicator.Ithasmanyofthefunctionstraditionallyfoundin
generalpurpose,ITorientedharddiskduplicatorsandprovidesfeaturesandfunctionsthatservethe
specializedneedsofforensicpractice,including:
Sustaineddatatransferratesofupto9GB/minute,whileperformingcalculationsofMD5and
SHA1hashvalues,alsoknownasfingerprints.
NativesupportforSATAandIDEharddisksfromthesourceinterface.
Parallelduplication,ortwinning,totwodestinationinterfacesforSATAharddisks.
Detailedloggenerationforcasedocumentation.
Automaticblankcheckingofsourceanddestinationdrives.
HPAandDCOsupportforthedetectionandhandlingofhidden/protecteddataareason
sourceanddestinationdrives.

Overview 3
TD2KitContents
TheTD2shipsinaboxedkitthatincludesthefollowing.Donotdiscardthefoampackaging.Itis
designedtofitseveralindustrystandardhardsidedcarryingcases.IfyoureceivedtheTD2kitinthe
cardboardboxshippedbyTableau,youcanbuyahardsidedcaseandreusethefoaminsertdirectly
inthatcase.
Item Model # Description
TD2 TD2 Forensic 1:2 Duplicator
TP4-NC High-output power supply. The TP4

provides enough power to supply the
TD2 and most common combinations
of source and destination hard disks.
The TP4 uses a universal 2-pin AC line
cord and is compatible with 110-
240VAC line voltages worldwide.
TP4-LC-US North America shipments include the

TP4-LC-US AC line cord for use with
the TP4-NC power supply. When
shipped to other geographic markets,
the local reseller typically adds an AC
line cord which is appropriate for the
local market.
TC2-8-R2 Hard disk power cable to connect IDE

and some legacy-style SATA hard disks
to the TD2 (3M to Molex).
TC3-8 SATA signal cable to connect SATA

hard disks to the TD2.
TC4-8-R2 SATA/SAS power/signal cable to SAS

signal and 3M power (2 pieces). This
unified cable connects power and
signal connectors current hard disks.

Item Model # Description
TC5-8-R2 Hard disk power cable to connect 15-

pin SATA power connectors to the TD2
(SATA to 3M).
TC6-8 IDE signal cable to connect IDE hard

disks to the TD2. Do not use the TC6-8
IDE cable to connect notebook drive
adapters to the TD2. Use the shorter
TC6-2 IDE cable shown with the TKA5-
AD adapter pack below.
TC7-6-6 6-pin FireWire/1394 signal cable. Used

to connect the TD2 to a host computer
for firmware updates.
TKA5-AD Adapter pack for notebook hard disks.

Includes TC6-2, TDA3-1, TDA5-18,
TDA5-25, and TDA5-ZIF w/TC20-BN
TQS-TD2 Quick Start card for TD2 kit.
Overview 5

NavigatingtheTD2
WhenusingtheTD2,youmaybepromptedtoentercertaininformationintothedisplay.Usethe
up/down/left/rightarrowkeysandthecenterbuttontoselectvalues.
Whileyouareenteringinformation,theTD2displaystwosoftkeyfunctionsatthebottomoftheLCD
display.Thesoftkeysperformmajoractionssuchasselectingatask,cancelingafunction,ormoving
betweendifferentdisplayscreens.Usethearrowkeypadtonavigatewithinagivenscreen/menu.The
functionofthesoftkeysdependsonthecurrentcontext.Thesoftkeysmighthavefunctionssuchas
[Back]and[Next],astheydoduringtheConfigurationWizard.Thesoftkeysmightalsoserveto
selectitemslike[Cancel]and[Ok].
Thecenterbuttononthearrowkeypadalsoservesasa[Select]buttonwhennavigatingamongTD2
menus.However,itcannotbeusedtostartmajortasks,suchasduplicationordiskwiping.Onlysoft
keyslabeled[Select]or[Start]initiatemajortasks.VerticalArrowKeysscrollupordownand
highlightmenuitemsforselection.HorizontalArrowKeysscrollleftorrightandtogglebetween
characterlists.
IntheupperleftcorneroftheMainmenu,theTD2displaysthedateandtime.Asyounavigatethe
TD2smenustructure,date/timeisreplacedbythemenuitemnumber.Forexample,theDuplicate
DiskmenuisMenu1,theDisktoDiskmenuisMenu1.1,andtheDisktoFilemenuisMenu1.2.
Thesemenunumbershelpyounavigatethemenuhierarchy.
TheTD2isshippedwithaQuickStartcardthatillustratesthelayoutofthedisplay,buttons,
connectors,andswitchesontheTD2.KeeptheQuickStartcardwiththeTD2asyoufamiliarize
yourselfwithitsoperation.


ReadingtheLEDs
ThefrontoftheTD2hassevenlightemittingdiodes(LEDs).Aneighthislocatedontherearedgeof
theTD2,nearthepowerconnector.
TheSATASourceandIDESourceLEDsindicatethatthesourcedriveisconnectedtotheleftsideof
theTD2.TheDestination1andDestination2LEDsindicatethatthedestinationdrivesareconnected
totherightside.AyellowAlertLEDontherightflashestoindicatetheneedforuserintervention.

USBKeyboardSupport
YoucanconnectastandardUSBkeyboardtoeitheroftheUSBportsonthefrontoftheTD2.Usinga
keyboardisoftenmoreconvenientthanenteringdatausingthearrowkeypadontheTD2.
WhenusingaUSBkeyboardtheEnterkeyonthekeyboardgenerallycorrespondstotherightsoftkey
ontheTD2.TheEsc(escape)keyonthekeyboardgenerallycorrespondstotheleftsoftkey.
Ifyourkeyboardhasarrowkeysoramouselikeinputdevice,theupanddownarrows(ormouse
actions)generallycorrespondtotheupanddown(vertical)arrowsontheTD2.

LCDContrast
ThefollowingpictureillustratesthefrontedgeoftheTD2.
Adjust the contrast of the TD2 LCD display by

using a small Phillips screwdriver to rotate the
contrast control located on the front of your TD2.
Overview 7

InThisChapter
Startup Sequence
Initialization
Configuring the TD2
User-Selected Startup Mode
Setup (Menu 9)
Connecting Hard Disks
Drive Detection

CHAPTER 2
Setting up the TD2

StartupSequence
TheTD2isoptimizedfortheneedsofforensicpractitionersandcomputerforensicprocesses.The
followingflowchartillustrateswhathappenswhenyouturnONtheTD2.

Initialization
AfteryouturnONtheTD2,itrunsasixsecondinitializationandselftestprocedurewhileitdisplays
thecopyrightnotice.AnLEDcheckisthenconductedsoyoucanverifythatalloftheLEDsare
functioning.Wheninitializationiscomplete,theTD2displayswarningmessagesaboutanydetected
faults.

Setting up the TD2 11

ConfiguringtheTD2
TheTD2comesreadytobeconnectedtotheTP4powersupplyandturnedON.
Afterrunningasixsecondinitializationandselftestprocedure,theTD2runstheConfiguration
Wizard.TheConfigurationWizardpromptsyouforthedefaultusername,currentdate/time,and
preferredstartupmode.TheTD2storesthesesettingsinnonvolatileflashmemoryforuseateach
startup.
ThestartupmodefeatureletsyoucustomizetheTD2foraspecificworkflow.TheStartupMode
settingprovidesthefollowingoptions.
DisktoDisk(cloning)fordiskcloning
DisktoFile(imaging)fordiskimaging
Mainmenu
YoucanconfigurethestartupmodeandothersettingsanytimefromtheSetupmenu(Menu9.4).
OnceyouhaveconfiguredyourTD2,thestartupsequencebypassestheConfigurationWizardunless
youhaveusedFactoryReset(Menu9.7)intheSetupmenu.

UserSelectedStartupMode
IfyouusetheTD2forduplicationonly,youcancustomizethestartupmodefordiskduplication.In
theStartupmenu,youcanchangethedefaultstartuptargetoftheTD2fromtheMainmenutoeither
DisktoDiskorDisktoFileduplication.

Setup(Menu9)
TheSetupmenuprovidesoptionsforsettingTD2options,defaults,andthecurrentdate/time.The
SetupmenualsoprovidesoptionsforviewingTD2informationandcurrentstatus.


SystemOptions(Menu9.1)
ThefollowingtablelistsadditionaloptionsandvaluesyoucansetinSystemOptions.
Option Choices Default Description
Startup
Di sk
Fi l e
Mai n Menu
Di sk
Specifies the TD2 startup mode as:
Disk = Disk-to-Disk duplication
File = Disk-to-File duplication
Main Menu = Main Menu
Examiner Name [Alphanumeric] NA
The Examiner Name option lets you set or
change the name of the examiner or user
of the TD2. This information appears in
each log recorded by the TD2.
Alphabetic names can be entered using
upper and lowercase letters and spaces.
The square brackets in the screen indicate
the selected data entry mode: enter an
upper case character, enter a lower case
character, enter a space (spc), or delete a
character (del). The up and down arrows
select the desired alphabetic character. The
center button on the arrow keypad enters a
letter or selects the delete function.
Once you have set the desired name, press
the [Save] soft key to record your changes.
Date and Time [Numeric] NA
The Date and Time option lets you set or
change the time stored by the real time
clock in the TD2.
The square brackets in the screen indicate
the currently selected field. Use the left and
right arrow keys to select the desired field.
Use the up and down arrow keys to change
the value in each field. Once you have set
the desired date and time, press the [Save]
soft key to record your changes.
Language NA NA Currently, TD2 only supports English.
Finished Alert
On
Of f
On
When On, the TD2 flashes the yellow Alert
LED at the end of a normal/successful
acquisition/task.
When Off, the TD2 flashes the yellow Alert
LED only if there is an unusual condition or
error.

ImagingOptions(Menu9.2)
ImagingOptionsletsyouspecifytheduplicatorstartupmodeandotheroptionsrelatedtodisk
duplication.
Thefollowingtableliststheoptionsandvaluesyoucansetforeachoption.
ImgType EnCase . e01
Raw/ DD
Pr ompt
Raw/ DD Specifies whether the Disk-to-File
operation creates an EnCase e01 file, a
Raw/DD file, or if the user should be
prompted at execution time.
Show ImgType On
Of f
Of f Specifies if the image type should be
displayed.
File Size 4 GB
2 GB
1 GB
700 MB
4 GB Segment size affects the size of file
segments written when performing
Disk-to-File (imaging) operations.
Dir Prompt Yes
No
No Specifies whether you will be prompted
to enter/override the default directory
name in a Disk-to-File acquisition.
Dir Name Dat e+Ti me
Ser i al Number
Model +Ser i al Num
Dat e+Ti me Specifies the default format for the
name of the directory assigned for each
acquisition.
Date+time generates a directory name
of the form yyyy-mm-dd hh-mm-ss
corresponding to the date/time at
which the duplication started.
File Prompt Yes
No
No Specifies whether you will be prompted
to enter/override the default filename
for each segment file in a Disk-to-File
acquisition.
File Ext Def aul t
DMG
Def aul t Specifies the file naming convention
used firing Disk-to-File duplication. In
default mode, the first segment is
named IMAGE001. In DMG mode, the
first chunk is named IMGE.DMG.
Case ID Pr ompt
Ski p
Pr ompt When set to Prompt, the TD2 prompts
you to enter a Case ID.
When set to Skip, the Case ID is
suppressed in subsequent TD2 logs.

Case Note Pr ompt
Ski p
Pr ompt When set to Prompt, the TD2 prompts
you to enter Case Notes.
When set to skip, the Case Notes are
suppressed in subsequent TD2 logs.
Err Recov Fast
Compl et e
Compl et e The TD2 supports two different error
recovery modes: fast and complete.
Err Limit No Li mi t
1000
100
One
Zer o
100 Specifies the maximum number of
errors allowed on the source drive.
Verify Hash On
Of f
On Specifies whether the TD2 verifies the
data written to the destination disk by
calculating the MD5 and SHA-1 hash
values. If set to On, the TD2 calculates
the hash on the destination drive after
the cloning/imaging process completes,
and then compare the hash values to
the values calculated at the time of
imaging.
Note: Verification can take as long as
the cloning/imaging process because all
of the data on the destination disk must
be re-read to calculate the hash. When
duplicating to a twinned pair of disks,
this process requires more time;
destination disks are verified one at a
time.
Restore Defaults Yes
No
NA Selecting this option automatically
restores all Options to the settings
shown in the Default column in this
table.
ThereisalsoaRestoreOptionsselectionunderImagingOptions.Selectingthisoptionautomatically
restoresallOptionstothesettingsshownintheDefaultcolumnintheprecedingtable.


ErrorRecoveryModes
TheTD2supportstwodifferenterrorrecoverymodes,CompleteandFast.Bothmodesrefertothe
wayinwhichtheTD2recoversfromreaderrorsonthesourceharddisk.
TheCompleteerrorrecoverymodeisthedefaultandmoreexhaustiveofthetwo.WhentheTD2
detectsareadfaultinCompletemode,itbeginsaretrystrategythatattemptstoreadeachsectorinthe
64sectorblockthatcontainstheerror.Completemodethereforeproducesthemostcomplete
destinationimage.However,theexhaustivestrategyusedbytheTD2canalsobetimeconsuming,if
thesourcedrivehasmanyreadfaults.
TheFasterrorrecoverymodeisintendedforusewithdrivesthathaveahighnumberofreadfaults.
WheninFastmode,theTD2treatsthesourcedriveasaseriesof64sectorblocks(32,768byteblocks).
Anerrorinany64sectorblockcausestheentireblocktobetreatedasanerror.ThisallowstheTD2to
movequicklythroughadrivewithmanyreadfaults,butatthelossofsomepotentiallyreadable
sectorsneareachfault.
Inbotherrorrecoverymodes,theTD2handlesunreadablesectorsinthesameway.WhentheTD2has
determinedthatasectorcannotbereadfromthesourcedrive,itfillsinthemissingdatawithzeroson
thedestinationdrive.ZerodatainsertedinthiswayisalsoincludedbytheTD2whencalculatingthe
MD5andSHA1hashesfortheduplication.
TheTD2treatsallmediaerrorsonadestinationdiskasfatalorunrecoverableerrorsbecauseeach
destinationdiskisreceivingacopyofevidencecriticaltoaforensicexamination.Itisnot
recommendedtostoredatatoadestinationdiskwithknowndefects.

TD2Info(Menu9.3)
SelectingtheTD2InfooptiondisplaysselectedinformationfortheTD2itself,asshowninthe
followingtable.
Legend Example Value Description

S/ N 01d1000c The TD2 serial number.
FWVer si on 1. 20 The TD2 firmware release.
FWDat e Oct 10 2008 The build date for the TD2 firmware release.
FWTi me 09: 05: 46 The build time for the TD2 firmware release.

FactoryReset(Menu9.4)
TheFactoryResetoptionresetsallTD2configurationsettingsanddefaultstothefactorystate.Factory
ResetalsodoesaphysicaleraseofalllogsstoredinTD2flash.
AfterperformingaFactoryResettheTD2retainsnouserspecificorcasespecificinformation.
TheonlysettingnotclearedbyaFactoryResetisthecurrentdateandtime.
InternallyStoredInformationprovidesadditionalinformationregardingdatastoredinnonvolatile
memorybytheTD2.


ConnectingHardDisks
Lookingfromthefrontview,makesuretoattachthesourcedrivetotheleftsideoftheduplicatorand
thedestinationdrive(s)totherightside.
ThefollowingprocedureprovidesthestepsforconnectingharddiskstotheTD2.Thisprocedure
appliestotypical3.5SATAandIDEharddisks.
ToconnectharddiskstotheTD2:
1. ConfirmthattheTD2powerswitchisOff(thePowerLEDwillbeOff).
2. ConnectthesourcediskwithitssignalcabletotheTD2signalinputusingtheappropriate
cable.
TC68IDEsignalcable
TC38SATAsignalcable
3. ConnectthesourcediskwithitspowercabletotheTD2powerinput.
TC28R2:IDE/SATAdrivepowercable
TC58R2:SATAdrivepowercable
4. ConnectthedestinationdiskordiskswiththeTC48R2:SATAdriveunifiedcable(s)tothe
TD2signal/poweroutput(s).
5. Note:TheTD2isequippedwiththeabilitytoconnecttwodestinationdiskstotheunitatthe
sametime.Currently,theTD2canwritetotwodestinationdrivessimultaneously(twinning).
Tocreateasinglecopy,connectadriveonlytotheDest1port.
6. OnthebackoftheTD2,connecttheTP4powersupplytotheTD2powerinput.
7. Usingtheappropriatelinecord,plugyourTD2intoanACpowersource.ThegreenDC
PowerInLEDindicatesthatpowerisavailableatthepowerconnector.
8. TurnOntheTD2bypressingtheTD2powerswitchlocatedonthefrontofthe unitto the
lowerleft.ThegreenPowerLEDindicatesthattheduplicatoristurnedOn.

Note: When connecting an IDE source disk to the TD1, always connect the blue end of the IDE cable (TC6-2 or
TC6-8) to the TD2 and the black end to the hard disk. If using other than a Tableau-supplied cable, ensure that the
colored stripe on the cable aligns with Pin #1 on the hard disk. Failure to do so can result in unreliable
communication between the hard disk and the TD2.

ConnectingNotebookHardDisks
Ifyouareconnectinga1.8or2.5notebookharddisk,usetheTC62IDEsignalcableinconjunction
withoneofthefollowingnotebookadapters:
TDA5181.8notebookadapter
TDA5252.5notebookadapter
TDA5ZIF1.8ZIFadapterandcables
TC2032ZIFcablefor0.2mmZIFconnectors
TC2033ZIFcablefor0.3mmZIFconnectors
Note: Only use the shorter TC6-2 (2") IDE cable when connecting a notebook drive adapter to the TD2. Do not use
the longer TC6-8 (8") IDE cable with notebook drive adapters. ZIF drives and some notebook drives require a very
short data path between the drive and the controller, so using anything except the 2" cable can result in unreliable
communication between the disk drive and the TD2.

DriveDetection
Afterinitialization,theTD2beginsdrivedetection.TheLCDindicateswhethersourceanddestination
driveshavebeenrecognized.
SteadyilluminationoftheSATASource,Destination1,andDestination2LEDsindicatesdrive
detection.IfyouhaveselectedaDisktoDiskorDisktoFilestartupmodeduringconfiguration,the
LCDcontinuallyindicatesdiskdetection.
Ifdrivesaredetectedonboththesourceanddestinationports,theLCDdisplaystheMainmenu.You
canthenviewdetailsofthedetecteddrivesbyselectingDiskInformation(Menu6).

InThisChapter
Overview
Duplicate Disk (Menu 1)
Preconditions Checking
Format Disk (Menu 2)
Wipe Disk (Menu 3)
Hash Utilities (Menu 4)
Blank Check (Menu 5)
Disk Information (Menu 6)
Disk Utilities (Menu 7)
Status Information
Logs (Menu 8)
Resetting and Clearing Internally Stored Information

CHAPTER 3
Using the TD2

Overview
ThischaptercoversdetailedproceduresandinformationforusingtheTD2.Itisorganizedaccording
totheTD2smenutreetofacilitatenavigationoftheTD2.

TD2MenusandOptions
ThemenusandscreensintheTD2arearrangedinatreestructure.UndertheMainmenu,eachbranch
ofthetreeisnumberedtoguideyouasyounavigatethemenutree.Thesenumbersalsomakeiteasy
toreferbacktothisguidefordetailedinformation.Thefollowingoutlineprovidesthemenustructure.
Mai n Menu
1. Dupl i cat e Di sk
1. 1 Di sk- t o- Di sk
1. 2 Di sk- t o- Fi l e
2. For mat
2. 1 For mat Dest
2. 1. 1 Qui ck FAT32
2.1.2 QuickexFAT
2. 2 For mat USB
2. 2. 1 Qui ck FAT32
2.2.2 QuickexFAT
3. Wi pe Di sk
3. 1 One Pass Wr i t e
3. 2 Mul t i Pass Wr i t e
4. Hash Ut i l i t i es
4. 1 Hash Sour ce
5. Bl ank Check
5. 1 Sour ce Di sk
5. 2 Dest - 1 Di sk
5. 3 Dest - 2 Di sk
6. Di sk I nf or mat i on
6. 1 Sour ce Di sk
6. 2 Dest - 1 Di sk
6. 3 Dest - 2 Di sk
7. Di sk Ut i l i t i es
7. 1 Sr c: Rmv DCO, HPA
7. 2 Sr c: Rmv HPA
7. 3 Dest Fr ee Space
Using the TD2 21

8. Logs
8. 1 Vi ew Logs
8. 2 Save Al l Logs
8. 3 Pr i nt Al l Logs
8. 3. 1 Newest t o Ol dest
8. 3. 2 Ol dest t o Newest
8. 4 Er ase Logs
9. Set up
9. 1 Syst emOpt i ons
9. 1. 1 St ar t up
9. 1. 2 Exami ner Name
9. 1. 3 Dat e and Ti me
9. 1. 4 Language
9. 1. 5 Fi ni shed Al er t
9. 2 I magi ng Opt i ons
9. 2. 1 I mgType
9. 2. 2 Show I mgType
9. 2. 3 Fi l e Si ze
9. 2. 4 Di r Pr ompt
9. 2. 5 Di r Name
9. 2. 6 Fi l e Pr ompt
9. 2. 7 Fi l e Ext
9. 2. 8 Case I D
9. 2. 9 Case Not e
9. 2. 10 Er r Recov
9. 2. 11 Er r Li mi t
9. 2. 12 Ver i f y Hash
9. 2. 13 Rest or e Def aul t s
9. 3 TD2 I nf o
9. 3. 1 S/ N
9. 3. 2 FWVer si on
9. 3. 3 FWDat e
9. 3. 4 FWTi me
9. 4 Fact or y Reset


DuplicateDisk(Menu1)
TheTD2duplicatesharddisksbyeithercloningorimagingthem.Cloning,alsoknownasdisktodisk
duplication,istheprocessofcopyingasourcedisk,sectorbysector,toadestinationdisk.Sourcedisk
sectoroneiscopiedtodestinationdisksectorone,thensectortwoiscopiedtosectortwo,sectorthree
tosectorthree,andsoon.Imaging,alsoknownasdisktofileduplication,istheprocessofcopyinga
sourcedisktoaseriesoffilesondestinationdisks.

DisktoDisk/Cloning(Menu1.1)
Followthesestepstoperformdisktodiskduplication.
1. FollowthestepslistedinConnectingHardDisksonpage16andturnONtheTD2.
2. FromtheMainmenu,usethearrowkeystonavigatetoDuplicateDisk>DisktoDisk(Menu
1.1).
3. Pressthe[Start]softkey.
4. EnteraCaseID.Toaborttheprocess,pressthe[Cancel]softkey.
5. EnteraCaseNote.Toaborttheprocess,pressthe[Cancel]softkey.Duplicationbeginsand
progressreportsappearontheLCD.Toseedetailedinformation,pressthe[Details]softkey.
Toterminateduplication,pressthe[Cancel]softkey.
6. Whentheprocessiscomplete,PrintorSavethelog.
Beforeduplication,theTD2performsaseriesofconditioncheckstodeterminewhethertoproceed.If
theTD2encountersaproblem,theTD2indicatestheproblem,andifnecessary,haltstheprocess.
Thefollowingtablelistsdetailsavailableduringdisktodiskduplicationorattheendofduplication.
Toseethesedetailsduringduplication,pressthe[Details]softkey.

Task Di sk t o Di sk
Indicates disk-to-disk duplication has been
selected.
St at
Ok
Er r or
I ncompl et e
Current status of the duplication.
Dat e 2008- 10- 14 Date on which the duplication started.
Using the TD2 23

Ti me 14: 54 Time at which the duplication started.
User Tabl eau
The name of the user. See Examiner Name
(Menu 9.1.2).
I D: 12345678 Case number or other identifying characters.
Not es: Twi n, 500GB Key information about the duplication.
- - Sour ce Di sk- -
Model ST380215A The model of the source disk.
S/ N 9RX7Y3DP Serial number of the source disk.
- - Dest - 1- -
Model WDC WD4000A The model of destination disk 1.
S/ N WD- WCAS838529 Serial number of destination disk 1.
- - Dest - 2- -
Model WDC WD4000A The model of destination disk 2.
S/ N WD- WCAS838530 Serial number of destination disk 2.
- - Er r or s- -
Count ed 0 Number of read errors on source disk.
Recor ded 0
Number of read errors recorded in the logs. This
may be less than the number of errors counted
if the log entry is full. Log entries can typically
record up to several hundred errors for each
logged operation.
- - Hashes- -
SHA- 1 <<no i nf o>> <<no info>> displays until the operation is
finished. Once the operation is finished, the
hash value displays.
MD5 <<no i nf o>>

DisktoFile/Imaging(Menu1.2)
Duringdisktofileduplication,theTD2performsanynecessarydestinationdiskformatting
automatically.Ifadestinationdiskalreadyhasanacceptableformatandsufficientfreespacetostore
atleastoneimagefile,theTD2usesthatformat.Ifadestinationdiskisnoteitherformattedorblank,
orifitlackssufficientfreespace,theTD2promptsyouforconfirmationtoformatthedisk.This
reducestheriskofoverwritingvaluabledata.
Inmostcases,theTableauTD2shouldbeturnedOffwhenyouconnectanddisconnectharddisks;
however,whenyouperformadisktofileduplication,thedestinationdiskmightbecomefull.When
thishappens,theTD2promptsyoutoconnectthenextdestinationdisk.DonotturnOfftheTD2
duringthisprocess.
1. FollowthestepslistedinConnectingHardDisksonpage16.
2. FromtheMainmenu,usethearrowkeystonavigatetoDuplicateDisk>DisktoFile(Menu
1.2).
3. Pressthe[Start]softkey.
Note: If you have enabled additional prompts (through Setup > Imaging Options or Setup > Case Info Options)
you will be prompted for additional information after pressing the [Start] soft key. By default, directory and
filename prompts are turned off. Through the Setup menus you can choose to enable prompts for those items as
well as for case ID and case notes fields.
4. EnteraCaseID.Toaborttheprocess,pressthe[Cancel]softkey.
5. EnteraCaseNote.Toaborttheprocess,pressthe[Cancel]softkey.Imagingbeginsand
progressreportsappearontheLCD.Toseedetailedinformation,pressthe[Details]softkey.
6. Whentheprocessiscomplete,PrintorSavethelog.
TheTD2offersahighdegreeofflexibilityinselectingdefaultsforeachkindoffieldsothatyoucan
configuretheTD2tomatchyourdesiredworkflow.
TheTD2supportsdiskspanning.TheTD2canspanasinglesourcediskacrossaseriesoffileson
multipledestinationdisks.TheonscreenTD2displayshowsinformationonlyforthefirstdestination
disk.ThelogrecordedinflashmemorybytheTD2recordsinformationforeachdestinationdisk,and
acopyofthelogiswrittentothelastdestinationdisk.

Using the TD2 25

Thefollowingtablelistsdetailsavailableduringdisktofileduplicationorattheendofduplication.
Toseethesedetailsduringduplication,pressthe[Details]softkey.

Task Di sk t o Fi l e
Indicates Disk-to-File duplication has been
selected.
St at
Ok
Er r or
I ncompl et e
Current status of the duplication.
Dat e 2008- 10- 14 Date on which the duplication started.
Ti me 14: 54 Time at which the duplication started.
User Tabl eau
The name of the user. See Examiner Name
(Menu 9.1.2).
I D: 12345678 Case number or other identifying characters.
Not es: Twi n, 500 GB Key information about the duplication.
- - Sour ce Di sk- -
Model ST380215A The model of the source disk.
S/ N 9RX7Y3DP Serial number of the source disk.
- - Dest - 1- -
Model WDC WD4000A
The model of the first of the dest-1 disks (see
note following this table).
S/ N WD- WCAS838531 Serial number of the first of the dest-1 disks.
- - Dest - 2- -
Model WDC WD4000A
The model of the first of the dest-2 disks (see
note following this table).
S/ N WD- WCAS838532 Serial number of the first of the dest-2 disks.
Fi l e Si ze 4. 0 GB
Indicates the file size being used for files on
the destination disk(s).
# of Fi l es 10
Number of files written (so far) to the
destination disk(s).
Di sk Count 1 Number of destination disk(s) used so far.
- - Er r or s- -

Count ed 0 Number of read errors on source disk.
Recor ded 0
Number of read errors recorded in the logs.
This may be less than the number of errors
counted if the log entry is full. Log entries can
typically record up to several hundred errors
for each logged operation.
- - Hashes- -
SHA- 1 <<no i nf o>> <<no info>> displays until the operation is
finished. Once the operation is finished, the
hash value displays.
MD5 <<no i nf o>>

FilesCreatedDuringDisktoFileDuplication
Whenperformingdisktofileduplicationorimaging,theTD2createsfilesonthedestinationhard
diskthatcontainthedatacopiedfromthesourceharddisk.
Filesarewrittentothedestinationdiskaccordingtothefollowingconvention:
( r oot di r ) /
TD2_I MG/
[ di r ect or y name] /
[ f i l ename] . E01

yyyy- mm- dd hh- mm- ss nnnnn TTT. LOG
[ di r ect or y name] isthenamegeneratedbytheTD2foreachseparateacquisition.Ifanacquisition
spansmultipledestinationdisks,thesame[ di r ect or y name] isusedoneachdestinationdisk.This
makesiteasytogroupimagefilesrelatedtoaparticularacquisition.
The[ di r ect or y name] canbeautogeneratedbytheTD2oryoucanenterityourself.Auto
generatednamescanbebasedonthedate/time,theserialnumberofthesourcedevice,orthemodel
andserialnumberofthesourcedevice.Theautogenerated[ f i l ename] isIMAGE,althoughyou
maychoosetooverridethisvalue.Foracompletelistoftheoptionsyoumayusetocontroltheauto
generationanduserpromptingfordirectoryandfilenames,seeImagingOptions(Menu9.2)onpage
12.
[ f i l ename] . 001isthefirstfile,orportionofthedatacopiedfromthesourcedisk.Thefilesizeisa
usersettableoptionandmayalsobespecifiedundertheSetup>ImagingOptionsmenu.Theremay
beamaximumof999filesforasinglediskcopy.Ifyouhavespecifiedafilesizethatrequiresmore
than999files,theTD2reportsanerrorandabortstheduplicationprocess.
WhencreatingaDDimage,youcanalsospecify.DMGnamingforfiles..DMGreferstoafilenaming
conventionusedbyAppleoperatingsystems.Ifthe.DMGnamingoptionisselected,thefirstfileis
namedIMAGE.DMGinsteadofIMAGE.001.Allotherfileshavestandardfilenames(forexample,
IMAGE.002,IMAGE.003,andsoon).
Using the TD2 27

A.LOGfileisgeneratedbytheTD2foreachdisktofileacquisition.yyyy- mm- dd hh- mm- ssisthe
duplicationtaskstartdate/time.Thenextfivecharactersnnnnnaregeneratedfromtheinternallog
IDnumberassignedtothelogbytheTD2.TheTTTinthefilenamereferstothetypeoftaskaslistedin
thefollowingtable.
Prefix Type of Log Entry/Task

BCK Blank Check
D2D Disk-to-Disk Duplication
D2F Disk-to-File Duplication
FMT Disk Formatting (destination only)
HPA HPA / DCO Operation
HSH Disk Hashing (source only)
WIP Disk Wiping (destination only)
ThethreecharactercodesintheabovetablematchthosedisplayedintheLogs>ViewLogsmenu.
Ifthedisktofileduplicationspansmorethanonedestinationdisk,thedirectorystructureshownin
theabovetableisreproducedoneachdestinationdisk.However,the.LOGfileiswrittenonlytothe
lastdiskintheset.

SwappingDestinationHardDisksduringDisktoFileDuplication
Inmostcases,theTableauTD2shouldbeturnedOffwhenyouconnectanddisconnectharddisks;
however,whenyouperformaDisktoFileduplication,thedestinationdiskmightbecomefull.When
thishappens,theTD2promptsyoutoconnectthenextdestinationdisk.DonotturnOfftheTD2
duringthisprocess.
Afterconnectingthenewdisk,pressthe[Continue]softkey.TheTD2checksthestatusofthenew
destinationdiskandpromptsyoutoformatit,ifnecessary.Theduplicationprocessthencontinues.


PreconditionsChecking
BeforestartingaDisktoDiskorDisktoFileduplication,theTD2automaticallychecksforanumber
ofpreconditions.Somepreconditionsarewarnings,andyoucanchoosetocontinueorcancelafter
viewingeachone.Somepreconditionsarefatalandrequirethattheduplicationprocessbeaborted.
Oneconditionpausestheprocessandpromptsyoutointervene.
ThefollowingtablesummarizesthepreconditionscheckedbytheTD2priortoduplication.
Name
Disk-to-Disk
or
Disk-to-File Type Explanation
Source Disk HPA Both Warning
Reports that HPA is in use on the source disk.

The TD2 automatically removes HPA on the
source disk. This warning indicates that an HPA
was present on the source disk.
Source Disk DCO Both Warning
Reports that DCO is in use on the source disk.

The TD2 does not automatically remove DCO on
the source disk, as doing so requires a permanent
modification of the source disk. You can cancel
the duplication and manually remove the DCO
using the Disk Utilities option under the Main
menu.
Destination Disk
HPA or DCO
Both Warning
Reports that either HPA or DCO is in use on the
destination disk.

The TD2 does not automatically remove HPA or
DCO on the destination disk. This warning notifies
you that the duplicator is not using the total size
of the destination disk. You can cancel the
duplication and manually remove the HPA / DCO
using the Disk Utilities option under the Main
menu.
Destination Disk
Too Small
Disk-to-Disk Fatal
For Disk-to-Disk duplication, the destination disk
must be at least as large as the source disk.
Segment Size Too
Small
Disk-to-File Fatal
For Disk-to-File duplication, the segment size
must be large enough so that the entire copy can
fit in 999 segments. You need to specify a larger
segment size using the Setup > Imaging Options
menu.
Source Disk May
Be Blank
Both Warning
The TD2 checks selected sectors on the source
disk looking for non-blank data patterns. If all of
the checked sectors appear to be blank, the TD2
warns that the source might be blank. This does
not mean that the source is necessarily blank, but
Using the TD2 29

Name
Disk-to-Disk
or
it could mean that the source has been partially
wiped or that an ATA password has been set for
the source drive.
Destination Disk
May Not Be Blank
Disk-to-Disk Warning
The TD2 checks selected sectors on the
destination disk looking for non-blank data
patterns. If the destination disk is not blank, an
unintentional overwrite is possible. This warning
provides the opportunity to abort the duplication.
Destination Disk
May Not Be Blank
Disk-to-File Warning
When performing Disk-to-File duplication the TD2
needs each destination disk to be formatted with
the FAT32 file system.

If the destination disk is already formatted for
FAT32, the TD2 uses this formatting without
overwriting any existing files.

If the destination disk does not have a FAT32 file
system, the TD2 can format one during
duplication.

If the destination disk appears to be blank, the
TD2 formats it without any warnings.
Duplication Will
Span Multiple
Destination Disks
Disk-to-File Warning
When performing Disk-to-File duplication, the
TD2 checks the available space on the destination
disk. If the destination disk appears to be too
small to receive the entire contents of the source
drive, the TD2 issues a warning, providing an
opportunity either to change disks or to proceed.
Twin disks must be
(re-)formatted
Both
User
Intervention
When performing Disk-to-File duplication to a
twinned pair of destination disks, to ensure a valid
mirroring process, the TD2 first verifies that the
twinned pair have identical content. If the TD2
determines, using blank check, that the twinned
pair are blank, it automatically formats the pair. If
either disk appears to be non-blank, the TD2
issues a warning providing an opportunity to
abort the duplication before formatting the
twinned pair.
When the TD2 formats a twinned pair, it stores a
special marker file on each disk. When this
twinned pair is later connected as a destination,
the TD2 then verifies it as a twinned pair by
detecting the identical markers and free space.
This process enables you to accumulate multiple
source images on large twinned pairs of
destination disks.
When formatting two destination disks, the TD2

Name
Disk-to-Disk
or
sets the usable capacity to be the lesser capacity
of the two drives.
Note: If either disk is connected to a Windows
system without a write blocker, Windows will
probably alter the disk contents. The TD2 will then
reject the altered twinned pair as invalid and
prompt you to reformat them. Reformatting an
invalidated twinned pair destroys any previously
collected images.
New destination
disk is full
Disk-to-File
User
Intervention
When performing Disk-to-File duplication, the
TD2 checks the available space on the destination
disk. If the destination disk does not have enough
room for a complete file, then the TD2 pauses and
requires you to change destination disks.

FormatDisk(Menu2)
Whenusingdisktofileimaging,thedestinationdrivemustbeformattedwithafilesystemthatis
recognizablebytheTD2.Currently,theTD2supportsdestinationdisksthatareformattedasFAT32or
exFAT.TheFAT32filesizelimitis4GB.TheexFATfilesizelimitis16EB(16,000,000TB).Whenfile
sizesarelargerthan4GB,exFATshouldbeused.
FromtheformattingmenuyoucanmanuallyformateitherthedestinationdiskoraUSBmassstorage
deviceattachedtooneoftheTD2sUSBports.
1. FromtheMainmenu,usethearrowkeystonavigatetoFormat(Menu2).
2. SelectFormatDest(Menu2.1)orFormatUSB(Menu2.2).
3. Selectthefilesystem(QuickFAT32orQuickexFAT).
4. Toconfirmyourselection,pressthe[Yes]softkey.Theformattingtaskbegins.

FormatDest(Menu2.1)
TheFormatDestoptionallowsyoutoformatthedestinationdiskwiththeFAT32filesystemusedby
theTD2.TheTD2doeswhatisgenerallyreferredtoasaQuickFormat.Inotherwords,theTD2
writesthenecessaryMasterBootRecord,PartitionBootRecord,andFAT32datastructurestothe
destinationdisk.TheTD2doesnotdoafullsurfacescanofthedestinationdisk.Ifyouwanttoverify
theintegrityofthedestinationdiskyoushouldformatitusingatraditionalcomputerandoperating
system.
YoudonotneedtopreformatdestinationdriveswhenusingtheDisktoFileduplicationmodeofthe
TD2.Ifadestinationdiskisunformatted,orformatted,andnotblank,theTD2promptsyoutoformat
itbeforebeginningtheduplication..

Using the TD2 31

LargeDiskSupport
TheTD2supportstwomethodsofformattingdisks:
MasterBootRecord(MBR)
GUIDPartitionTable(GPT)
Ingeneral,disksoflessthan2TBareformattedwiththeMBRoption.Disksgreaterthan2TBare
formattedwithGPT.LargediskscanbeformattedwithMBR,butonlythefirsttwoterabytesofspace
areused.
TheGPTformatinvolvescreatingmultiplepartitionsofupto2TBeach.WhenaGPTdiskisattached
toaWindowssystem,Windowsassignseachpartitionadriveletter.
Intheformattingstep,whentheTD2recognizesalargediskgreaterthan2TB,amenudisplays:
Lar ge di sk f ound.
Sel ect di sk f or mat .
TwosoftkeysallowyoutoselectGPTorMBR.Iftwodestinationdisksareconnected,twinningis
selected.Theformattingoperationformatstothecapacityofthelowercapacitydrive.Ifthiscapacity
islessthan2TB,theMBRformatisusedregardlessofthesizeofthelargerdrive.

AdvancedFormatSupport
Traditionally,harddriveshavehadaninternalstructurebuiltaroundsectorsof512bytes.Newer
drives,especiallydriveswithcapacitiesgreaterthan2TB,featuretheAdvancedFormat(AF)structure
thatusesinternalsectorsof4096bytes.SuchdrivesstillsupportI/Otransfersthatreference512
sectors;internally,thedrivesmapthesereferencestotheinternal4096bytephysicalsectors.Implicit
inthismappingistheneedtoaccommodatewritesthatalterthedatastoredinjustaportionofa
physicalsector.Thisisaccomplishedbyaninefficientreadmodifywritecycle.
Historically,diskshavebeenformattedwiththefirstpartitionlocatedatsector63.However,ifahost
computeralignspartitionsandclustersof512bytesectorsonboundariesthatarenotamultipleof8,
thenthefrequencywithwhichthedrivemustresorttoreadmodifywritecyclescanseverelydegrade
performance.
TheTD2recognizesAFdisks.Itformatsthemaccordinglywithpartitionsandclusterspositionedat
sectorlocationsthatareamultipleof8.
IfanAFdiskispairedwithanonAFdiskfortwinning,theyarebothareformattedinaccordance
withtherulesforoptimumAFalignment.

FormatUSB(Menu2.2)
TheFormatUSBoptionallowsyoutoformataUSBmassstoragedeviceconnectedtooneoftheTD2s
USBports.YoumustattachaUSBmassstoragedevice,suchasathumbdrive,tooneoftheTD2s
USBportsbeforeselectingthisoption.
Note: You can attach only one USB mass storage device to the TD2 at a time. Connecting more than one USB
mass storage device to the TD2's USB ports may lead to confusing results, as you cannot tell which USB mass
storage device the TD2 is using.


WipeDisk(Menu3)
Youmaywishtowipethedestinationdiskbeforeuse,especiallywhendoingdisktodiskcloning.The
TD2givesyoutwooptionstowipeadestinationdisk:youcanperformafast,onepasswipeora
multipasswipe.
1. FollowthestepslistedinConnectingHardDisksonpage16andturnONtheTD2.Nosource
diskisnecessary.
2. FromtheMainmenu,usethearrowkeystonavigatetoWipeDisk(Menu3).
3. SelectOnePassWrite(Menu3.1)orMultiPassWrite(Menu3.2).
4. Toconfirmyourselection,press[Yes].Thewipingtaskbegins,andprogressreportsappearon
theLCD.
Note: If you connect two destination disks of different sizes, the Wipe Disk utility wipes an area
equal to the capacity of the smaller drive. To fully wipe the larger of two destination drives,
connect it to the Dest-1 port as the only destination drive.
OnePassWrite(Menu3.1)
TheTD2writesaconstantpatternofzeros(00h)tothedestinationdriveinasinglepass.TheTD2will
displayonscreenperformanceandtimingmetricsduringthewipingprocess.
Youmaycancelthewipingoperationatanytimebypressingthe[Cancel]softkey.
Note: The TD2 will not automatically overwrite an HPA or DCO on the destination drive.

MultiPassWrite(Menu3.2)
TheTD2performsfullpassesofwritestothedestinationdrive.Thefirstpasswriteszeros(00h),the
secondpasswritesones(FFh),andthethirdpasswritesarandomlyselectedconstantvaluebetween
01handFEh.TheTD2willdisplayonscreenperformanceandtimingmetricsduringthewiping
process.
Youmaycancelthewipingoperationatanytimebypressingthe[Cancel]softkey.

HashUtilities(Menu4)
Therearetimeswhenaforensicpractitionerwouldliketocalculatethehashvalues,orfingerprints,
forasourcediskwithoutmakingacopyofthedisk.WiththeHashUtilitiesmenu,youcangenerate
anMD5andSHA1hashvaluefortheharddiskattachedtothesourcesideoftheTD2.
Youcancancelthehashingoperationatanytimebypressingthe[Cancel]softkey.
IfthesourcediskhasanHPAprotectedregion,theTD2automaticallydisablestheHPAbefore
performingthehashcalculation.ThisisthesameastheTD2sbehaviorduringduplication.Ifyou
comparethehashvaluesproducedwhenduplicatingadiskandwhenusingtheHashUtilities,you
shouldgetthesamehashresults.
Whenthehashingoperationisfinished,theTD2promptsyoutopressthe[Ok]softkey.After
pressing[Ok],youseeaHashOptionsmenu:
Hash Opt i ons
1. Vi ew Hash
2. Compar e t o Logs
Using the TD2 33

SelectingViewHashletsyouviewtheMD5andSHA1hashresultsontheTD2display.TheMD5and
SHA1hashresultsaretoowidetodisplaycompletelyonscreen,soyoumayusetheleftandright
arrowkeystoscrollthehashresults.
SelectingComparetoLogsletsyouseequicklyifyouhaverecentlyperformedanyothertaskswith
thesamesourcedriveonthisTD2unit.TheTD2willsearchthelogsstoredinflashmemorylooking
foranyDisktoDisk,DisktoFile,orHashlogentriesthathavematchinghashvalues.Ifthereareany
matchingentries,theTD2displaysalistofthem.

BlankCheck(Menu5)
TheBlankCheckmenuletsyoudoaquickblankcheckonthesourceoreitherdestinationdrive.
TheTD2performsaquickchecktodetermineiftheselecteddiskappearstobeblankbyreading
sectorsintheMasterBootRecord,thePrimaryGPT,andtheSecondaryGPT.Asectorisconsideredto
beblankifitcontainsonlyarepeatingpatternsuchas00h,E5h,orFFh.Anynonrepeatingpatternis
consideredtobenonblank.IfallsectorsreadbytheTD2haverepeatingpatterns(thoughnot
necessarilythesamerepeatingpattern),thentheTD2concludesthedrivemaybeblank.
Thisquickcheckisnotanexhaustivecheckoftheentiredrive.Itispossibleforadrivetoappeartobe
blankaccordingtothequickcheckwhilestillstoringforensicallyrelevantinformation.Aforensic
examinershouldtreatblanksourcediskswithsomesuspicionanduseothertools,likeaTableauwrite
blocker,toexaminethedrivetoseeifitcontainsforensicallyrelevantinformation.

DiskInformation(Menu6)
TheTD2candisplaydetailedinformationforthesourceorthedestinationharddisk(s).SourceDisk
(Menu6.1)displaysinformationfortheSATAorIDEharddiskattachedtothesourcesideoftheTD2.
theDest1andDest2(Menus6.2and6.3)displayinformationfortheharddisksattachedtothe
destinationsideoftheTD2.
ThefollowingtableliststhediskinformationdisplayedbytheTD2:
Legend Example Value Definition
Model ST380215A The model name reported by the hard disk
through the ATA IDENTIFY command.
S/ N 9RX7Y3DP The serial number reported by the hard disk
Fi r mRev 3. AAD The firmware revision reported by the hard disk
Capaci t y 40. 0 GB The capacity of the hard disk as it will be
copied/used by the TD2.
LBA 20, 000, 000 The capacity in sectors as reported by the hard
disk at power ON.
HPA 78, 125, 000 The capacity in sectors as reported by the hard
disk using the ATA HPA (Host Protected Area)
feature set.
DCO 156, 301, 488 The capacity in sectors as reported by the hard
disk using the ATA DCO (Device Configuration

Legend Example Value Definition
Overlay) feature set.
HPA i n use Yes Yes if the ATA HPA feature set is being used to
reduce the apparent capacity of the hard disk.
DCO i n use Yes Yes if the ATA DCO feature set is being used to
reduce the apparent capacity of the hard disk.
Sec i n use No Yes if the ATA Security feature set may be in use
to password protect the contents of the hard
disk.
Cabl e I DE IDE or SATA.
PI O mode PI O 4 The PIO (Programmed I/O) mode being used by
the TD2 to communicate with the hard disk.
DMA mode UDMA 5 The DMA or UDMA mode being used by the TD2
to communicate with the hard disk.

DiskUtilities(Menu7)
TheTD2offersseveralutilitiestoassistwiththeprocessingofdrives.Theseutilitiescanbefoundin
Menu7.

RemovalofDCOandHPARegions
TheTD2automaticallydetectstheuseoftheATAHPA(HostProtectedArea)andDCO(Device
ConfigurationOverlay)featuresets.BothHPAandDCOfeaturesetscanbeusedtoreducethe
apparentcapacityofaharddisk.FromaforensicpointofviewitisvaluabletoknowifHPAand/or
DCOareinuse.Withthatknowledge,theforensicpractitionercanmakeaninformeddecisionabout
whetherornottoacquiredatainthehiddenregionsofthedrive.
YoucandisableHPAwithoutmakingapermanentmodificationtothedrive,sotheTD2automatically
disablesHPAonanyharddiskconnectedtothesourcesideoftheduplicator.Itisnot,however,
possibletodisableDCOwithoutmakingapermanentmodificationtotheharddisk.Forthisreason,
theTD2willnotautomaticallydisableDCOonthesourceharddisk.
TheTD2nevermakesautomaticchangestoHPAandDCOonadestinationharddisk.TheTD2is
designedusingtheassumptionthattheforensicpractitionerhascompletecontroloverthedestination
harddisk.IfyouchoosetorestrictthedestinationdrivecapacityusingHPAorDCO,theTD2willnot
overridethatdecision.TheTD2cannotdisableHPAorDCOonthedestinationdisk(s),however,the
TD2doesdetectandwarnaboutDCOonthedestinationdisk(s).
TheoptionswithintheDiskUtilitiesmenuallowyoutopermanentlydisableeitherjusttheHPAor
boththeDCOandHPAonthesourcedisk.

Using the TD2 35

RemoveDCO&HPA(Menu7.1)
YoucannotremoveaDCOprotectedregiononaharddiskwithoutalsoremovinganyHPAprotected
region.IfyouwanttopermanentlyremoveboththeHPAandDCOoneitherthesourceordestination
harddisk,usetheoptionsunderthismenu.

RemoveHPA(Menu7.2)
YoucanremoveanHPAprotectedregiononaharddiskwithoutmakinganychangestotheDCO
settingsontheharddisk.IfyouwanttopermanentlyremovetheHPAoneitherthesourceor
destinationharddisk,usetheoptionsunderthismenu.

DestFreeSpace(Menu7.3)
Toquicklydeterminethefreespaceontheattacheddestinationdrive,selectDiskUtilities>DestFree
Space(Menu7.3).Thisoptiondisplaysthecapacityofthedriveandtheavailablespace.

StatusInformation
Duringlongdiskoperationsincludingduplication,wiping,andstandalonehashing,theTD2displays
fiveperformance/timingmetricsinarotatinglooptotrackprogressoftheselectedoperation.
Thefollowingtableexplainseachoftheperformance/timingmetricsdisplayedbytheTD2.
Metric Displayed As Description

Elapsed Time El apsed: mi n sec
Total elapsed time since the start of the
current task.
Time Remaining Ti meRem: mi n sec
Estimated remaining time for the current
task. This time is calculated using the
amount of data remaining divided by the
average transfer rate.
Instantaneous Transfer Rate
(bytes per second)
I nst ant : xxx MB/ sec
The average over the most recent six
seconds, displayed both in bytes per
second and bytes per minute.
Instantaneous Transfer Rate
(bytes per minute)
I nst ant : yyy GB/ mi n
Average Transfer Rate
(bytes per minute)
Aver age: yyy GB/ mi n
The average rate since the start of the
current task.
Arotatingmediaharddisktransfersdatafasteratthebeginningofduplicationthanattheend.Expect
toseetheinstantaneoustransferrateatthebeginningofaduplicationtaskdecreaseupto50%bythe
endofthetask.Thistransferratedecreaseisnormalanddoesnotindicateaproblemwithanyofthe
harddisksinvolvedortheTD2.


Logs(Menu8)
WhenevertheTD2performsanoperationwhichreads,writes,ormodifiesaharddisk,itcreatesalog
entrytorecordthatoperation.
TheTD2hasaninternalflashmemorywiththecapacitytostoreapproximately59ofthemostrecently
loggedoperations.OncetheTD2hasstored59logentries,thecreationofanewlogentrywill
automaticallyoverwritetheoldestlogentry.
TheLogsmenuletsyouview,print,save,anderaselogentries.

ViewLogs(Menu8.1)
SelectingtheViewLogsoptiondisplaysalistofthelogscurrentlyrecordedintheTD2sinternalflash
memory.Themostrecentlogentryisdisplayedatthetopofthislistwiththeoldestlogentryatthe
bottom(end)ofthelist.Logentriesaredisplayedas:
10- 13 12: 46 Wi p Ok
10- 13 12: 45 Wi p X
Thefirstpartofthelineisthemonthanddate(MMDD)onwhichthelogwasrecorded.Thesecond
partisthetimeatwhichthelogwasrecorded(HH:MM)usinga24hourclockformat.
Thethirdpartofeachlineisathreecharactercodeindicatingthetypeoftaskrecordedinthelog.For
acompletelistingofthethreecharactercodes,seeWritingLogstoaUSBStorageDeviceonpage39.
Intheaboveexample,Wi p referstoaDiskWipingoperation.
Thelastpartofthelineisanabbreviationindicatingtheresultoftheloggedoperation:
Result Definition
Ok Task completed normally.
Er Task completed with an error.
X Task was aborted or canceled by the user.
NC
Task did not finish. This might happen if the duplicator is
turned off in the middle of the task.
Usetheupanddownarrowstoscrollthroughthelistoflogentries.Asmallsidewaystriangle
indicatesthecurrentlyselectedlogentry.Toviewthecurrentlyselectedentry,pressthe[Select]soft
key.

Using the TD2 37

SampleTD2Log
TheTD2maintainsdetailedlogsforeachtaskinitiatedbytheuser.Hereisasampleofanerrorfree
logforaDisktoFileacquisition.
- - - - - - - - - - - - - - - - - - - - - - - - - St ar t of Tabl eau TD2 Log ent r y- - - - - - - - - - - - - - - - - - - - - - - - -

Task: Di sk t o Fi l e
St at us: Ok
Cr eat ed: 2008- 08- 14 13: 15
Cl osed : 2008- 08- 14 13: 43
User : Tabl eau
Case I D:
TD2 Demonst r at i on
Case Not es:
The TD2 i s an awesome f or ensi c dupl i cat or !

Dupl i cat or ser i al num: 01d1101a
Dupl i cat or f i r mwar e t i mest amp: Aug 12 2009 11: 43: 33
Dupl i cat or f i r mwar e r evi si on: 2. 10
Dupl i cat or l og I D num: 7

- - - - - - - - - - - - - - - - - - - - - - Di sk- t o- Fi l e Resul t s- - - - - - - - - - - - - - - - - - - - - -

# of sect or s: 293, 046, 768 ( 150. 0 GB)
Dest i nat i on f i l ename convent i on: Def aul t
Segment si ze i n sect or s: 7, 812, 480 ( 3. 9 GB)
Segment s expect ed: 38
Segment s wr i t t en: 38
Fi l ename of f i r st segment : TD2_I MG/ WDC WD1500HLFS- 01G6U0_WD- WXLY08147051/ I MAGE. 001
Tot al er r or s: 0
Er r or s r ecor ded: 0
SHA1: 813d0f 6bf 853d6681314911f e6f e02c9b96ecbd8
MD5 : af 995be7c61f c0a8f f e052b842f babbd

- - - - - - - - - - - - - - - - - - - - - - - - - - Sour ce Di sk- - - - - - - - - - - - - - - - - - - - - - - - - - -

Model : WDC WD1500HLFS- 01G6U0
S/ N: WD- WXLY08147051

Fi r mwar e Revi si on: 04. 04V01
Capaci t y i n sect or s r epor t ed Pwr - ON: 293, 046, 768 ( 150. 0 GB)
Capaci t y i n sect or s r epor t ed by HPA: 293, 046, 768 ( 150. 0 GB)
Capaci t y i n sect or s r epor t ed by DCO: 293, 046, 768 ( 150. 0 GB)
HPA i n use: No
DCO i n use: No
ATA Secur i t y i n use: No
Cabl e/ I nt er f ace t ype: SATA
ATA PI O mode: PI O 4
ATA DMA mode: UDMA 5
Peak power :
+5V : 4. 81 V 691 mA
+12V: 12. 2 V 335 mA

-----------------------Destination Disks------------------------

Dest i nat i on di sks used: 1
Dest i nat i on di sks r ecor ded: 1

- - - - - - - - - - - - - - - - - - - - - - Dest - 1 Di sk #1- - - - - - - - - - - - - - - - - - - - - - -

Model : WDC WD3000GLFS- 01F8U0
S/ N: WD- WXL508028462
Fi r mwar e Revi si on: 03. 03V01
Capaci t y i n sect or s r epor t ed Pwr - ON: 586, 072, 368 ( 300. 0 GB)
Capaci t y i n sect or s r epor t ed by HPA: 586, 072, 368 ( 300. 0 GB)
Capaci t y i n sect or s r epor t ed by DCO: 586, 072, 368 ( 300. 0 GB)
HPA i n use: No
DCO i n use: No
ATA Secur i t y i n use: No
Cabl e/ I nt er f ace t ype: SATA
ATA PI O mode: PI O 4
ATA DMA mode: UDMA 5
Peak power :
+5V : 4. 74 V 746 mA
+12V: 12. 5 V 298 mA
- - - - - - - - - - - - - - - - - - - - - - - - - - End of Tabl eau TD2 Log ent r y- - - - - - - - - - - - - - - - - - - - - - - - - -
Using the TD2 39

IftheTD2haddetectedanybadsectorsonthesourcedrive,itwouldhaveaddedasectionattheend
oftheTD2log.Thisadditionalsectionwouldlistthesectoraddressandsectorlengthofeach
unreadableregionofthesourcedisk.

SaveAllLogs(Menu8.2)
YoucansavealllogstoaUSBstoragedeviceconnectedtooneoftheTD2sUSBports.After
connectingaUSBstoragedevicetooneoftheTD2sUSBports,selecttheSaveAllLogsoptiontosave
thelogs.LogsaresavedinanASCIItextformat.Useatexteditorofyourchoicetoviewthelogs.

WritingLogstoaUSBStorageDevice
TheTD2letsyouwritelogstoaUSBstoragedeviceandadherestothefollowingdirectoryand
namingconventions:
( r oot di r ) /
TD2_I MG/
LOGS/
SSSSSSSS/
yyyy- mm- dd hh- mm- ss nnnnn TTT. LOG
Here,SSSSSSSSistheshortformserialnumberfortheduplicator.Thiseightdigitserialnumberis
thesameastheserialnumberyoufindprintedonthebottomoftheTD2.01D1000Cisanexampleof
avalidTD2serialnumber.
Theformatofthe.LOGfilenameisdescribedinFilesCreatedDuringDisktoFileDuplication.

PrintAllLogs(Menu8.3)
YoucanprintalllogstoaUSBprinterattachedtooneoftheTD2sUSBports.AfterconnectingaUSB
printertooneoftheTD2sUSBports,selectthePrintAllLogsoptiontoprintthelogs.Afterselecting
PrintAllLogsyouwillbeaskedtoselectwhetherlogsshouldbeprintedintheorderofNewestto
OldestorintheorderofOldesttoNewest.
TheTD2iscompatiblewithUSBprinterswhichsupporttheUSBPrinterClassSpecification.TheUSB
printermustsupportrawASCIIprinting.

EraseLogs(Menu8.4)
IfyouwanttoerasethelogsstoredintheTD2sinternalflashmemory,selectingtheEraseLogsoption
performsaphysicaleraseoftheflashmemoryinwhichthelogsarestored.Itisnotpossibletorecover
thelogsafterEraseLogsisfinished.


ResettingandClearingInternallyStoredInformation
Someforensicandsecurityapplicationsrequirethattheuserbeawareofthekindsofinformationthat
theduplicatorcanstore.Insomecases,youmaywanttoknowwhat,ifany,informationispreserved
bytheunitfromoneacquisitiontothenext.Oryoumightbeinsecuritysensitiveenvironmentsand
needtobeabletosanitizeequipmentbeforethatequipmentcanberemoved.
TheTD2hasthreeseparatenonvolatilememories.
ThefirstnonvolatilememoryisaflashdevicewhichisusedtostoretheTD2sfirmwareandserial
number.ThefirmwarecanbeupdatedusingtheTableauFirmwareUpdateutility(availablefrom
TableausWebsite).Thisflashdeviceisneverusedtorecordanyuserspecificoracquisitionspecific
information.
Thesecondnonvolatilememoryisaseparateflashdeviceusedtostoretwodifferenttypesof
information:configurationsettingsandlogs.Configurationsettingsincludethefollowing.
User/operatorname(enteredviaConfigurationWizardorSetupMenu).
Startupmodeofoperation(enteredviaConfigurationWizardorSetupMenu).
Errorhandlingsettings(errorrecoverystrategyanderrorcounterlimits).
Defaultdirectorynamingconventionsfordisktofileduplication(directorynameformat).
Defaultfilenamingconventionsfordisktofileduplication(filenameformat).
Defaultfileformatconventions(segmentsize,etc.).
LastusedcaseIDandcasenotes(ifcaseinformationisenabled).
Userpreferencesforprompts(directoryname,filename,caseinformation).
Thissecondflashalsorecordsupto59ofthemostrecenttasksperformedbytheduplicator.Ataskin
thiscontextisanyoperationwhichoperatesonadiskdevice,includingduplication,formatting,
wiping,hashing,blankchecking,andHPA/DCOoperations.Logsincludedetailedinformationabout
eachdiskdeviceattachedtotheTD2;thisincludesthemake/model,serialnumber,capacity,andso
on.
Thethirdandfinalnonvolatilememoryistheonboardrealtimeclock(RTC)withbatterybackup.
Therealtimeclockrecordsthedateandtimeassetbytheuser.Therealtimeclockdoesnotrecord
anyuserspecificoracquisitionspecificinformation.
Thefollowingtableliststhereset/clearinformationstoredinternallybytheTD2.
Non-Volatile
Memory
Information
Stored
User or
Case-Specific
Info Ability to Reset/Clear
Flash #1
TD2 firmware

None
Firmware cannot be erased, but can
be updated using the Tableau
Firmware Update program, which
can be downloaded from
Tableau's Web site.
TD2 serial number None
It is not possible to change the TD2
serial number in the field.
Flash #2 TD2 configuration User-specific
All configuration settings can be
erased and restored to factory
defaults by selecting Setup >
Factory Reset.
Configuration settings (excluding
Using the TD2 41

Non-Volatile
Memory
Information
Stored
User or
Case-Specific
Info Ability to Reset/Clear
user name and startup mode) can
be reset to defaults using Setup >
Imaging Options > Restore
Options.
TD2 configuration
Case-specific (if case
ID/notes are enabled)
All configuration settings can be
erased and restored to factory
defaults by selecting Setup >
Factory Reset.
Alternately, the Case ID/Notes can
be disabled through Setup > Case
Info Options.
TD2 logs
User-specific and Case-
specific
All logs can be erased by either
selecting Logs > Erase Logs or
Setup > Factory Reset.
Alternately, logs can be erased
individually. When viewing a
specific log entry, select the
[Options] soft key, then select
Erase Log.
Real-Time Clock Date/Time None
The Date/Time cannot be restored
to a factory default state. However,
after performing a Factory Reset,
the TD2 prompts you to change the
Date/Time within the Setup Wizard.
The Date/Time can also be changed
by selecting Setup > Date and
Time.
TheFactoryResetandEraseLogsoptionsphysicallyerasetheflashmemorycorrespondingtoeach
item.Itisnotpossibletorecoversettingsorlogentriesaftertheflashmemoryhasbeenphysically
erased.

InThisChapter
Troubleshooting Common Problems
Support

CHAPTER 4
Troubleshooting and
Support

TroubleshootingCommonProblems
Thissectionprovidesthefollowingtroubleshootingissuesandsolutions:
PowerSupplyIssues
ProblemswithDiskDetection
ReplacingtheBackupBatteryfortheRealtimeClock
PowerSupplyIssues
TheTP4powersupplyprovidedwiththeTD2isa24volt(16V28V)powersupplythatusesabarrel
connectortointerfacewiththeTD2.ItiscapableofpoweringtheTD2andnearlyallcombinationsof
one,two,orthreeharddisks.TheTD2alsoemploysstaggeredpowersequencingforthesourceand
destinationharddisks.Withstaggeredsequencing,powerisfirstprovidedtooneharddiskasitspins
up,thentothesecondharddiskasitspinsup,andfinallytothethirdharddisk.Itisnormaltohear
thesourceanddestinationdrivesspinupseparately.
DuringpowerOninitializationandselftest,theTD2willchecktheoutputvoltagesoftheTP4power
supply.Ifthevoltageisbelowtheminimumspecification,theTD2displaysanonscreenwarning.
ThereisagreenDCpowerLEDontherearedgeoftheTD2,nexttothefemaleDCpowerbarrel
connector.IftheTP4powersupplyisconnectedproperlytotheTD2andtoACpower,thegreenLED
illuminates.IfyouarehavingdifficultyturningtheTD2On,checkthestatusoftheDCpowerLEDto
ensurethattheTD2isreceivingpowerfromtheTP4powersupply.

ProblemswithDiskDetection
WhenusingaproductliketheTD2,themostcommonproblemusersencounterisafailuretoachieve
drivedetection.Mostdrivedetectionproblemsaretheresultofimpropercabling.Thefollowingtable
liststhemostcommondrivedetectionproblemsandcorrectiveactions.
Problem Corrective Action

Hard disk does not spin up.
Check the power connection between the TD2 and the hard
disk. Be especially careful to ensure that the 4-pin power
connectors are properly seated in the connectors on the TD2
and on the hard disk (if using cable model TC2-8). The blue
connectors should be fully inserted, not loose, in the TD2 and
hard disk.
TD2 does not detect IDE hard disk. IDE hard disks should be set for Master or Single Drive.
TD2 does not detect 3.5" IDE hard disk.
Normal 3.5" IDE hard disks can be connected to the TD2 using
either the 8" TC6-8 IDE cable or the 2" TC6-2 cable. In either
case, the blue end of the IDE cable must be connected to the
TD2.
You must not use an IDE cable longer than 8" with the TD2.
Always use the Tableau-provided, high-quality, 80-conductor
TC6-8 or TC6-2 cable.
TD2 does not detect notebook IDE hard
disk.
When using one of the notebook drive adapters provided with
the TD2 (model TDA5-18, TDA5-25, or TDA5-ZIF), you must
always use the 2" TC6-2 IDE cable. When using a notebook
drive adapter, do not use the 8" TC6-8 IDE cable or any non-
Troubleshooting and Support 45

Problem Corrective Action
Tableau IDE cable.
When using notebook drive adapters, the blue end of the TC6-2
IDE cable must be connected to the TD2, and the black end of
the cable must be connected to the notebook drive adapter.
TD2 does not detect ZIF-style notebook
IDE hard disk.
There are several models of ZIF hard disks. When using the
TDA5-ZIF kit provided with the TD2, refer to the Support pages
on Tableau's Web site for documentation regarding the
proper selection and orientation of ZIF cables.
TD2 does not detect SATA hard disk.
Use only the 8" TC3-8 SATA cable provided by Tableau. With
some SATA hard disks, the SATA connector might be loose.
Ensure that the TC3-8 cable is seated properly in the hard disk's
SATA connector.
TableauhastestedtheTD2withanextensiveinhouselibraryofdifferentharddisksspanningmany
yearsofharddiskdevelopment,buttheremightbecompatibilityissueswithsomeharddisks.
Tableauissuesfirmwareupdatestoaddressmostcompatibilityissues.Ifyourharddiskisnot
recognizedbytheTD2,checktheSupportpagesonTableausWebsitetoseeifanyfirmwareupdates
areavailablefortheTD2.

ReplacingtheBackupBatteryfortheRealtimeClock
TheTD2usesarealtimeclock(RTC)withabackupbattery.Thebatteryhasashelflifeof1218
months.IfyouusetheTD2regularly,expectthebatterytolastlongerthan18months.Asthebattery
discharges,theTD2displaysalowbatterywarningmessage.
ThissectionprovidesanillustratedprocedureforreplacingtheRTCbackupbattery.

CompatibleBatteries
TheTD2usesanANSI/NEDAtype5012LCbattery.Thefollowingtablelistsseveralcommonbatteries
compatiblewiththistype.
Manufacturer Model #
Duracell DL1220
Energizer CR1220
Rayovac CR1220

OpeningtheTD2
ItisnecessarytoopentheTD2caseinordertoreplacethebattery.Youneeda#1Phillipsscrewdriver
toopentheTD2caseandasmallflatbladescrewdrivertoremovethebattery.
ThefollowingprocedureprovidesthestepsforopeningtheTD2.
1. DisconnectallthepowersupplyandallcablesfromtheTD2beforeopeningtheTD2case.
NeverconnectthepowersupplyoroperatetheTD2whenthecaseisopen.
2. Afterdisconnectingthepowersupplyandallcables,turntheTD2upsidedownonaclean
worksurface.
3. Removethefourscrewsandsetthemaside.Thefollowingphotographshowsthelocationof
thefourcasescrews.
Therearhalfoftheplasticenclosurepartiallysurroundsthe1394connector.Thispreventsyou
fromliftingtherearhalfofthecaseinastraightdirection.
4. CarefullylifttherearhalfoftheplasticcaseawayfromtheTD2bytiltingandpullingit
towardyou.KeeptheTD2secureonyourworksurface.LiftingortiltingtheTD2mightmove
themaincircuitboard,loosenaconnector,andcauseasystemfailure.


5. CarefullysettherearhalfoftheTD2caseaside.Thefollowingphotographshowstheexposed
maincircuitboard.
Note: Lifting the main TD2 circuit board away from the front half of the enclosure might loosen
the flex cable connector and cause a system failure. Reattaching the flex cable requires special
skill.
6. Carefullyliftthebackofthemaincircuitboard(leftsideintheabovephotograph),andusing
theflexcableasapivot,spreadthemaincircuitboardflat,asshowninthephotographbelow.

Thebackupbatteryislocatedonthebackofthemaincircuitboard,asshowninthe
photographbelow.

ReplacingtheBattery
Thefollowingphotographshowsdetailsofthebatterylocation,highlightedinred.
1. Usingtheflatbladescrewdriver,prythebatterygentlyfromthebatteryholder.
2. Usingacompatiblebattery,replacetheRTCbackupbattery.Foralistofcompatiblebatteries,
seeCompatibleBatteriesonpage45.
Note: Make sure the positive terminal of the battery is facing upward.


ClosingtheTD2
Becauseoftheshapeofthe1394connector,replacingtherearhalfoftheTD2scaserequiressomecare.
ToreplacetheTD2scase:
1. Tiltthebottomedgeoftherearcaseintoposition.
2. TipthecasedownwardwhilesimultaneouslyaligningtheUSBand1394connectorsatthe
bottomofthecase.
3. Ensurethatthecaseandmaincircuitboardarealignedandreplacethefourcasescrews.The
fourscrewsthatholdtheTD2casetogetheralsosecurethemaincircuitboard.
4. Afterreplacingthefourcasescrews,inspecttheTD2anddeterminewhetherthecaseistightly
secured.

TestingtheNewBattery
AfteryouhavesecurelyfastenedtheTD2scase,returnittoitsnormaluprightpositionandattachjust
theTP4powersupply.TurntheTD2Onandobservethestartupsequence.Youshouldnotseea
batterywarningdialog,butyouwillprobablyseeadate/timewarningtoresettheRTC.
Toresetthedate/time,fromtheTD2Mainmenu,selectSetup>DateandTime.Fordetailed
informationaboutsettingthedateandtime,seeDateandTime(Menu9.1.3).
Afterresettingthedate/time,turntheTD2Off,waittwominutes,andturntheTD2ON.The
date/time,locatedintheupperleftcorneroftheMainmenushouldbecorrect.


Support
GuidanceSoftwaredevelopssolutionsthatsearch,identify,recover,anddeliverdigitalinformationin
aforensicallysoundandcosteffectivemanner.Sinceourfoundingin1997,wehavemovedinto
networkenabledinvestigationsandenterprisewideintegrationwithothersecuritytechnologies.
Thissectionprovidesinformationonoursupportforyouthrough:
TechnicalSupport
OnlineSupportPortal
ProfessionalServices
Training
TechnicalSupport
SupportforyourTableauproductisprovidedbythevendorwhosoldthedevice.Additionalsupport
canalsobefoundbyvisitingthesupportpagesontheTableauWebsiteat:
www.tableau.com/support
Hereyouwillfindanswerstocommonquestions,informationregardingspecificcompatibilityissues,
andfirmwareupdatesfortheTD3ForensicDuplicator.
IfyoupurchasedyourdevicefromGuidanceSoftware,technicalsupportisavailable24hoursaday,
excludingweekendsandholidays.Alltechnicalsupportinquiriesareautomaticallyroutedtotheopen
USorUKoffice:10PMSunday6PMFriday,USPacifictime(6AMMonday4PMFriday,GMT).
GuidanceSoftwareoffersseveralsupportoptions,including:
LiveChat
SupportRequestForms
Email
Telephone
LiveChat
FromtheGuidanceSoftwareSupportPortal,userscanchatlivewithaTechnicalServicesengineer.
FromtheSupportPortalmainpage,selectLiveChattoconnectdirectlytoanengineer.

TechnicalSupportRequestForms
PleaseusetheOnlineRequestFormtorequestassistancefromaTechnicalServicesengineer.Toaccess
theform,clickRequestForm(https://support.guidancesoftware.com/node/381)intheSupportPortal.
Notethatallfieldsaremandatory,andfillingthemoutcompletelyreducestheamountoftimeittakes
toresolveanissue.

Email
Althoughtechnicalsupportisavailablebyemail,youwillreceivemorethorough,quickerservice
whenyouusetheonlineTechnicalSupportRequestForm,availableat:
(https://support.guidancesoftware.com/node/381).
Torequestassistancebyemail,sendtotechnicalsupport@guidancesoftware.com.Pleaseincludeas
muchdetailaspossibleabouttheissueandthebestwaytocontactyou.


Telephone
Telephonetechnicalsupportisavailable24hoursaday,excludingweekendsandholidays.All
technicalsupportcallsareautomaticallyroutedtotheopenUSorUKoffice:10PMSunday7PM
Friday,USPacifictime(6AMMonday3AMSaturday,UKtime).
USOfficehours:MondayThursday5AM10PMPacifictime,Friday5AM7PMPacifictime.
Tel:(626)2299191,Option4
Fax:(626)2299199
215NorthMarengoAvenue,Suite250
Pasadena,CA91101
UKOfficehours:MondayFriday6AM4PMUKtime.
Tel:+44(0)1753552252,Option4
Fax:+44(0)1753552232
ThamesCentral,5thFloor
HatfieldRoad
Slough,BerkshireUKSL11QE
Foryourconvenience,thefollowingnumbershavebeenprovidedtoourEnglishbasedsupport:
Germany:08001814625
China:108001300976
Australia:1800750639
HongKong:800964635
NewZealand:0800450523
Japan:00531130890
OnlineSupport
GuidanceSoftwareoffersaSupportPortaltoourregisteredusers,providingtechnicalforums,a
knowledgebase,abugtrackingdatabase,andanOnlineRequestform.ThePortalgivesyouaccessto
allsupportrelatedissuesinonesite.Thisincludes:
User,product,betatesting,andforeignlanguageforums(messageboards)
KnowledgeBase
BugTracker
TechnicalServicesRequestform
Downloadsofprevioussoftwareversions,drivers,etc.
Otherusefullinks
Althoughtechnicalsupportisavailablebyemail,youwillreceivemorethorough,quickerservice
whenyouusetheonlineTechnicalSupportRequestForm
(https://support.guidancesoftware.com/node/381).Notethatallfieldsaremandatory,andfillingthem
outcompletelyreducestheamountoftimeittakestoresolveanissue.
IfyoudonothaveaccesstotheSupportPortal,pleaseusetheSupportPortalregistrationform
(https://support.guidancesoftware.com/forum/register.php?do=signup).

Registration
Registrationrequiresyoutochooseauniqueusernameandpassword.Pleaseprovideallrequested
information,includingdongleID,phone,emailaddress,organization,etc.Thishelpsusidentifyyou
asaregisteredownerofEnCase.
Youwillreceiveanemailreplywithin24hours.Youmustfollowthelinkinthatemailbeforeyoucan
postontheforums.Onceyouhaveverifiedyouremailaddress,youwillbeaddedtotheRegistration
List.Pleaseallow24businesshoursforyouraccounttobeapproved.
Onceyourregistrationisapproved,youcanaccesstheSupportPortal
(https://support.guidancesoftware.com/).TheSupportPortalprovidesanoverviewtutorialofthesite.
User,Product,andForeignLanguageForums
Toaccesstheforums,clicktheForumTab(https://support.guidancesoftware.com/forum/)inthe
SupportPortal.
Theforumsallowregistereduserstopostquestions,exchangeinformation,andholddiscussionswith
GuidanceSoftwareandotherusersintheEnCasecommunity.Severaldiscussiongroupsareavailable,
including:
ForeignLanguageGroups
French
Arabic
German
Spanish
Japanese
Chinese
Korean
ForumGroups
UserGroup
ConsultantandPractitioner
ComputerForensicHardwareIssues
EnScriptForum
ProductSpecificGroups
EnCaseNeutrino
Enterprise
FieldIntelligenceModel(FIM)
eDiscovery
Thesegroupsareavailableonlytocustomerswhohavepurchasedtherespectiveproducts.
Enteragroupbyclickingthegroupname.

PostingtoaGroup
Tocreateanewpost,clickthe icon.
Clickthe icontoreplytoapost,orusetheQuickReplyiconatthebottomofeachpost.
Searching
Theforumscontainovertenyearsofaccumulatedinformation.UsetheSearchbuttontosearchfor
keywords,orclickAdvancedSearchformorespecificsearchoptions.
BugTracker
UseBugTrackertosubmitandcheckthestatusandpriorityofsubmitteddefectandenhancement
requests.Itisbrokendownbyproduct,showingthecurrentnumberofbugs/enhancementsandpublic
bugsforeachproduct.ToaccesstheBugTracker,clickBugTracker
(https://support.guidancesoftware.com/forum/project.php)intheSupportPortal.
KnowledgeBase
Youcanfindanswerstofrequentlyaskedquestions(FAQs)andotherusefulproductdocumentation
intheKnowledgeBase.YoucanalsosubmityourownarticlestohelpotherEnCaseusers.
ToaccesstheKnowledgeBase,clickKnowledgeBase
(https://support.guidancesoftware.com/directory)intheSupportPortal.
Fromhere,youcanbrowse,search,andwriteKnowledgeBasearticles.
OnlineTechnicalSupportRequestForm
PleaseusetheRequestFormforassistancefromaTechnicalServicesengineer.Toaccesstheform,
clickRequestForm(https://support.guidancesoftware.com/node/381)intheSupportPortal.

MessageBoards
TheGuidanceSoftwaremessageboardsareresourcesforthecomputerforensicscommunityto
exchangeideas,askquestions,andgiveanswers.Themessageboardsareavaluableresourceforthe
forensicinvestigator.
Discussionsrangefrombasicacquisitiontechniquestoindepthanalysisofencryptedfilesandmore.
Thousandsofexperiencedandskilledusersareregisteredontheboards,reviewingpostseveryday,
andprovidingtheirexpertiseonallGuidanceSoftwareproducts.
Moreinformationaboutthemessageboards,includinginformationonhowtojointhemessageboard,
islocatedathttp://www.guidancesoftware.com/support/messageboards.asp
http://www.//guidancesoftware.com/support/messageboards.asp.
Downloads
Whenyoureceiveyourproduct,registerwithGuidanceSoftwaretoreceiveupdates.Registrationis
locatedathttps://www.guidancesoftware.com/myaccount/registration.aspx.
Ifyouhavedifficultiesregisteringyourproduct,contactCustomerService.Ifyouhavedifficulties
downloadingtheupdates,onceregistered,contactTechnicalSupport.
OtherUsefulLinks
TheSupportPortalslandingpagecontainsasectionofusefullinks,including:
GuidanceSoftwareHomePage
DownloadCentertodownloadsoftware,hardware,manuals,bootdisks,supportarticles,etc.
MyAccounttoregisteryourdongleidtoreceiveuptodatesoftwarebyemail
NVD(NationalVulnerabilityDatabase)InformationandResponses
GuidanceProductVersionMatrixforcheckingcompatibilityofdifferentproductversions
HardwareRecommendationsforEnCaseForensicandEnCaseEnterprise
SubscribetoPublicBugs


ProfessionalServices
TheGuidanceSoftwareProfessionalServicesDivision(PSD)combinesworldleadingcomputer
investigationexpertswithworldleadingforensictechnologytodeliverturnkeysolutionstoforensic
investigations.
GuidanceSoftwarehascombineditsindustryleadingcomputerinvestigationtechnologywithateam
ofthemosthighlytrainedandcapableinvestigatorsintheworldtobringyoucompleteturnkey
solutionsforyourbusiness.Whenyoufaceinvestigativeissuesthatgobeyondyourinternal
capabilities,ourprofessionalservicesgroupisabletorespondeitherremotelyorbycomingonsiteto
providetherighttechnologyandcomputerinvestigationpersonnelforthejob.
InternalInvestigations
Theftofintellectualproperty
Intrusionreconstruction
Wrongfulterminationsuit
Compliance
SarbanesOxley
PIIriskassessment
CaliforniaSB1386
eDiscovery
Pendinglitigation
Responsiveproduction
Forensicpreservation
InformationSecurity
Compromiseofsystemintegrity
Policyreview
Unauthorizeduse
Forensiclabimplementation
Training
GuidanceSoftwareoffersavarietyofprofessionalcoursesforthebeginner,intermediate,and
advanceduserofallitsapplications.Inadditiontoprovidingasolidgroundinginoursoftware,we
alsoprovideourstudentswithacceptedbestpracticesforinvestigation,reportgenerationand
evidencepreservation.
GuidanceSoftwareofferscoursesforlawenforcementagencies,organizationsconcernedwith
forensicsandincidentresponse,andgivestraininginadvancedtopicsforallusers.
InformationaboutallGuidanceSoftwaretrainingofferingsisavailableat:
http://www.guidancesoftware.com/computerforensicstraining.htm.

Index
A
AboutthisGuide4
AdvancedFormatSupport31
B
BlankCheck(Menu5)33
C
ClosingtheTD249
CompatibleBatteries45
ConfiguringtheTD211
ConnectingHardDisks16
ConnectingNotebookHardDisks17
ConventionsUsedinthisGuide4
D
DestFreeSpace(Menu7.3)35
DiskCapacityandTransferRateMeasurement
Conventions4
DiskInformation(Menu6)33
DiskUtilities(Menu7)34
DisktoDisk/Cloning(Menu1.1)22
DisktoFile/Imaging(Menu1.2)24
DriveDetection17
DuplicateDisk(Menu1)22
E
Email50
EraseLogs(Menu8.4)39
ErrorRecoveryModes15
F
FactoryReset(Menu9.4)15
FilesCreatedDuringDisktoFileDuplication26
FormatDest(Menu2.1)30
FormatDisk(Menu2)30
FormatUSB(Menu2.2)31
H
HashUtilities(Menu4)32
I
ImagingOptions(Menu9.2)13
Initialization10

L
LargeDiskSupport31
LCDContrast6
LiveChat50
Logs(Menu8)36
M
MultiPassWrite(Menu3.2)32
N
NavigatingtheTD25
O
OnePassWrite(Menu3.1)32
OnlineSupport51
OpeningtheTD246
Overview1,20
P
PowerSupplyIssues44
PreconditionsChecking28
Preface3
PrintAllLogs(Menu8.3)39
ProblemswithDiskDetection44
ProfessionalServices55
R
ReadingtheLEDs6
RemovalofDCOandHPARegions34
RemoveDCO&HPA(Menu7.1)35
RemoveHPA(Menu7.2)35
ReplacingtheBackupBatteryfortheRealtime
Clock45
ReplacingtheBattery48
ResettingandClearingInternallyStored
Information40
S
SampleTD2Log37
SaveAllLogs(Menu8.2)39
SettinguptheTD29
Setup(Menu9)11
StartupSequence10
StatusInformation35
Support50
SwappingDestinationHardDisksduringDiskto
FileDuplication27

SystemOptions(Menu9.1)11
T
TableauTD22
TD2Info(Menu9.3)15
TD2KitContents3
TD2MenusandOptions20
TechnicalSupport50
TechnicalSupportRequestForms50
Telephone51
TestingtheNewBattery49
Training55
TroubleshootingandSupport43
TroubleshootingCommonProblems44
U
USBKeyboardSupport6
UserSelectedStartupMode11
UsingtheTD219
V
ViewLogs(Menu8.1)36
W
WipeDisk(Menu3)32
WritingLogstoaUSBStorageDevice39

Tableau TD2 Users Guide-1

Încărcat de

Informații document

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

Tableau TD2 Users Guide-1

Încărcat de

Drepturi de autor:

Formate disponibile

Tableau TD2 Version 4.

4 Tableau TD 2 Version 4.01 User's Guide

2 Tableau TD 2 Version 4.01 User's Guide

Item Model # Description

TD2 TD2 Forensic 1:2 Duplicator

TP4-NC High-output power supply. The TP4

TP4-LC-US North America shipments include the

TC2-8-R2 Hard disk power cable to connect IDE

TC3-8 SATA signal cable to connect SATA

TC4-8-R2 SATA/SAS power/signal cable to SAS

4 Tableau TD 2 Version 4.01 User's Guide

TC5-8-R2 Hard disk power cable to connect 15-

TC6-8 IDE signal cable to connect IDE hard

TC7-6-6 6-pin FireWire/1394 signal cable. Used

TKA5-AD Adapter pack for notebook hard disks.

TQS-TD2 Quick Start card for TD2 kit.

6 Tableau TD 2 Version 4.01 User's Guide

Adjust the contrast of the TD2 LCD display by

10 Tableau TD 2 Version 4.01 User's Guide

Setting up the TD2 11

12 Tableau TD 2 Version 4.01 User's Guide

Setting up the TD2 13

14 Tableau TD 2 Version 4.01 User's Guide

Setting up the TD2 15

Legend Example Value Description

16 Tableau TD 2 Version 4.01 User's Guide

Setting up the TD2 17

20 Tableau TD 2 Version 4.01 User's Guide

Using the TD2 21

22 Tableau TD 2 Version 4.01 User's Guide

Legend Example Value Description

Using the TD2 23

24 Tableau TD 2 Version 4.01 User's Guide

Using the TD2 25

Legend Example Value Description

26 Tableau TD 2 Version 4.01 User's Guide

Using the TD2 27

Prefix Type of Log Entry/Task

28 Tableau TD 2 Version 4.01 User's Guide

Using the TD2 29

30 Tableau TD 2 Version 4.01 User's Guide

Using the TD2 31

32 Tableau TD 2 Version 4.01 User's Guide

Using the TD2 33

34 Tableau TD 2 Version 4.01 User's Guide

Using the TD2 35

Metric Displayed As Description

36 Tableau TD 2 Version 4.01 User's Guide

Using the TD2 37

38 Tableau TD 2 Version 4.01 User's Guide

Using the TD2 39

40 Tableau TD 2 Version 4.01 User's Guide

Using the TD2 41

44 Tableau TD 2 Version 4.01 User's Guide

Problem Corrective Action

Troubleshooting and Support 45

46 Tableau TD 2 Version 4.01 User's Guide

Troubleshooting and Support 47

48 Tableau TD 2 Version 4.01 User's Guide

Troubleshooting and Support 49

50 Tableau TD 2 Version 4.01 User's Guide

Troubleshooting and Support 51

52 Tableau TD 2 Version 4.01 User's Guide

Troubleshooting and Support 53