OpenTextâ„¢ is excited to announce the availability of Logical Imaging and Search for the Tableau Forensic Imager (TX1) along with multiple other new features and enhancements included in the TX1 2.0 release. This major release for the TX1 is available as Tableau Firmware Update (TFU) 7.25. The Tableau TX1 is a powerful and intuitive forensic imager that offers superior local and networked imaging performance with no compromises. The latest version is packed with new features, enhancements and fixed issues to address the evolving challenges in forensic data acquisitions, while improving performance and usability.New Features Available in the TX1 2.0 Release :
• Logical Imaging & Search
Users can now acquire forensically-sound logical images from locally attached drives and network shares. Further, users can image the entire filesystem, manually select specific folders and files, or use the powerful Files to Acquire screen to define a targeted search profile using pre-defined and custom criteria. The Files to Acquire search function provides a basic (default) and advanced mode, which can be easily enabled and disabled in the default settings screen. This tool saves valuable time by focusing on specific files of interest rather than acquiring the entire physical drive. The TX1’s logical imaging understands the structure of the recognized filesystem and acquires the desired source file data and/or metadata.
• Detect Drives with Whole Disk Encryption
Automatically detect drives encrypted with the following whole disk encryption types: Microsoft BitLocker & BitLocker To Go, Apple FileVault 2, Linux LUKS, BestCrypt, and Symantec PGP Disk. When the TX1 detects an encrypted drive, it displays an information message indicating the encryption type on the drive tile summary and the drive detail screen. The encryption type is also reported in the forensic log.
• Detect Apple Fusion Drives on Apple Macs
Detects and presents both HDD and SSD physical drives configured as one Fusion Drive on Apple Macs connected to the TX1 in Target Disk Mode. Fusion Drives are configured on some Apple iMacs and Mac Minis.
• Display More USB Device Descriptors
The following USB descriptors are now displayed in the USB device media detail screen and reported in the forensic log: Class, SubClass, Protocol, VID (Vendor ID), and PID (Product ID).
To view the full Release Notes for TFU 7.25 or to update your current TX1 units: CLICK HERE
New to Tableau products? CLICK HERE for additional product information and complete the ‘Contact Tableau’ form to request follow up from one of our product experts.
