Today’s Tableau catalog offers USB 3.0 support across a variety of forensic products: from write blockers to forensic duplicators. Our experience and our forensic customers tell us that when given the choice, they will always choose the fastest computer connection or system interface available to them. We’ve focused on USB 3.0 because of its speed and prevalence in today’s computer systems. The USB 3.1 specification (released in 2013) doubles the current theoretical rate for USB 3.0, ensuring a long lifecycle for USB 3 technology.In 2012, Guidance Software launched the first USB 3.0 write blocker: the Tableau™ T35u SATA/IDE Forensic Bridge. As larger, faster rotational and solid-state storage media have become the norm, advantages offered by the T35u’s USB 3 technology became apparent. Shorter forensic imaging times, simpler connection options, and reliable hot-swapping of drives are all benefits offered by this USB 3.0 forensic product.
USB 3.0 is the at the Heart of Tableau OEM-style Forensic Bridges
All new Tableau OEM-style forensic bridges integrate to the host computer motherboard via USB 3.0. This insures optimum forensic imaging performance while minimizing integration issues. Currently, Guidance Software builds three USB 3.0 OEM-style forensic bridges: the UltraBay 3d™, the T35689iu, and the T3iu Forensic SATA Imaging Bay.
The T35689iu and the UltraBay 3d offer similar write blocking capabilities. The UltraBay 3d differs by including an integrated touch-screen User Interface. This allows for localized control and monitoring of forensic imaging without the need for a separate monitor. Additionally, the UltraBay 3d supports expansion of write blocking capabilities: additional Tableau write blockers can be integrated with the UltraBay 3d via built-in serial ports.
The Tableau 3iu is three products in one: a high performing forensic bridge, a drive tray, and a drive cooler–all in a single half-height, bay-mount package.
Benchmarked Forensic Imaging in Excess of 16 GB/min
Tableau engineers are constantly working to improve the maximum imaging performance of our forensic bridges. We test and benchmark our products using a wide variety of hard drives and other storage devices. In our internal tests, we always measure “forensic mode” performance. Forensic mode is defined as imaging while simultaneously calculating MD5 and SHA-1 hashes. This is an important distinction between Tableau product performance and competing product: MD5 and SHA-1 are always on for Tableau products.
The above chart represents forensic mode imaging speeds obtained when using one of our newer products: the Tableau T3iu Forensic SATA Imaging Bay. Using a high speed SATA SSD, forensic imaging speeds in excess of 16 GB/min were measured. Similar SATA imaging speeds were obtain when using the T35u and T35689iu (variant) products. While performance in the field or lab is largely governed by suspect devices and forensic imaging software, write blocker performance does make a real difference. For example, a best practice when imaging SSDs is to limit the amount of time that power is applied to suspect SSDs. The shorter SSDs are powered on, the less chance there is that SSD garbage collection and TRIM processes may occur. The sooner forensic imaging is complete, the sooner the SSD can be powered off. Simply put, speed matters.
Tableau TD3 Forensic Imaging Systems offer both USB 3.0 Write Blocking and Output Options
In addition to forensic imaging of SATA, IDE, SAS, FireWire, and networked (iSCSI) storage devices, the Tableau TD3 Forensic Imaging System has supported write-blocked USB 3.0 device acquisitions since its launch in late 2012. In Q4 2013 we responded to requests from TD3 users by delivering a USB 3.0 output expansion module, the TDPX8-RW. This module easily connects to the expansion port on the TD3. TD3 still supports directing evidence output to SATA or network devices (iSCSI or CIFS). The new TDPX8-RW module allows users to optionally direct forensic imaging output to a USB 3.0 device. Fast and easy to use, the TDPX8-RW USB 3.0 output module is a standard component of all new TD3 kits.
As we look to the future, USB 3.0 technology will continue to be a key element of new Tableau forensic products. For more information about our focused drive to deliver high-performing USB 3.0 forensic products, please visit us at
www.guidancesoftware.com/tableau
