The Forensic Imager 3
The Forensic Imager 3 is truly one of a kind. At its core the Forensic Imager 3 is a high performance, reliable, and easy to use forensic duplicator - with a high resolution, touch screen User Interface (UI). It supports forensic imaging of SATA, IDE, USB 3.0, SAS, and FireWire (1394 A/B) storage devices and iSCSI network shares. No other forensic duplicator available today matches Forensic Imager 3 for its unique combination of performance, modular packaging, forensic capabilities, and usage models.
Monitor and Control with a Unique Touch-screen UI
Central to the uniqueness of the Forensic Imager 3 is a high-resolution, color touch screen user interface, used to control and monitor ongoing operations. Designed to be powerful yet simple to use, this wizard driven UI uses simple touch gestures to select and initiate all functions. To facilitate easy data entry, the Forensic Imager 3 includes a pop-up software touch-screen keypad for entering data, reviewing logs, connecting to networks, or completing setup. If a physical keypad is preferred, connect an external keyboard thru the general purpose USB 2.0 port.
Collect Evidence from a Variety of Storage Drives, Including SAS
The Forensic Imager 3 supports collecting data in a forensically sound (a.k.a. "write-blocked") manner. SATA, USB 3.0, USB 2.0/1.1, and FireWire devices connect directly to the Forensic Imager 3 using the appropriate port. IDE and SAS devices can be imaged through the IDE TDPX5 (included) and the optional SAS TDPX6 (pictured to the right) expansion modules. The kit includes the IDE Protocol Module. As an option, you can purchase the SAS module. Keyed guides in the TDS2 SATA enclosure allow for easy connecting of TDPX modules with the Forensic Imager 3 expansion port.
Multiple Options for Safekeeping Your Evidence
The Forensic Imager 3 offers a variety of evidence storage options. New for 2014 is the TDS2 SATA Drive Enclosure. TDS2 supports easy, "tool-less" hard drive insertion and removal. The locking handle on TDS2 enables easy hard drive replacement while also securing hard drives within the enclosure. No need for cable connections when using TDS2. The SATA power and signal connections are made directly between the Forensic Imager 3 and TDS2.
TDS2's are built to support simultaneous imaging to two SATA drives. Simply connect two TDS2's one on top the other to enable "twinning mode".
Many examiners prefer to image directly to bare hard drives. The Forensic Imager 3 supports imaging to bare hard drives or to other legacy Tableau Modular Storage Products with the appropriate cables (included in the kit).
Additionally, the Forensic Imager 3 has a Gigabit Ethernet connection that can be used to image or upload previously imaged evidence directly to iSCSI or CIFS network files shares.
Output to USB 3.0 with the TDPX8-RW Module
Forensic Imager 3 users have the flexibility and performance of writing out to USB 3.0 storage devices with the TDPX8-RW USB 3 Expansion Module. When connected to the Forensic Imager 3 expansion port, TDPX8-RW can be selected as an output destination in the Forensic Imager 3 setup parameters. Simply connect your USB 3.0 storage device and go!
Enhanced Networking Options
For network based forensic acquisitions, remote triage applications, or network based "write blocking", the Forensic Imager 3 comes with an integral network connection. New for 2014 is the optional TDPXE Gigabit Ethernet expansion module. This module offers the flexibility of two additional network connections and improved networking performance.
Advancing the Art of Modular Design
Each Forensic Imager 3 system is built to directly connect to a Tableau TDS2 SATA Drive Enclosure, as shown in this picture. When imaging a SATA, USB 3.0/2.0/1.1, or FireWire (1394 A/B) device, simply connect the device to the appropriate port on the Forensic Imager 3. Imaging SAS and IDE devices is just as easy: simply slide the appropriate TDPX Expansion Module in place, connect the storage device, power up Forensic Imager 3, and image.
View Drives and Collect Evidence as a Remote Write Blocker
There are instances when central command may want or need to preview or collect data from a storage device located thousands of miles away. When used as a network-based write blocker, the Forensic Imager 3 supports this. With the appropriate IP address, remote PCs can access the Forensic Imager 3 via the internet. Storage devices connected to Forensic Imager 3's write blocked ports are presented as an iSCSI target. In this manner, remote PCs can browse or even collect data from the remote storage device. In many instances, accessing data remotely is more convenient and possibly safer than physically transporting the storage devices.
Which Usage Mode Do You Need?
The Forensic Imager 3 provides the usage mode flexibility that is required by forensic professionals today. Below are the various ways that it can be adapted to your forensic process:
Imaging to Local Hard Drives
Imaging to Network Shares
Imaging Apple Macs in Target Disk Mode
Network Based Write Blocking
Forensic Imager 3 Key Features
- Disk-to-File Duplication (Compressed
.e01 & .ex01)
- Disk-to-Disk Duplication (Cloning)
- Compute Hash Values
- Verify Hash Values
- HPA/DCO Disable
- Blank Check Drives
- Format Drives
- Wipe Drives
- Display, Print, and Save Logs
- Secure User Profiles
Forensic Imager 3 Kit Contents
- Forensic Imager 3
- Adapter Kit Which Includes 2" IDE Cable, 2.5" and 1.8" HD Adapters, MicroSATA and ZIF Adapter in Zippered Case
- SATA LIF Adapter
- TP5 Universal Power Supply with TCA-MF-BNDL Power Connectors
- TDS2 SATA Storage Module
- TDPX8-RW USB3 Output Expansion Module
- TDPX5 IDE Protocol Module
- TC2-8-R2 3M to Molex Cable
- TC3-8 SATA Data Cable
- TC4-8-R2 SAS Integrated With 3M Cable
- TC5-8-R2 3M to SATA Power Cable
- TC6-8 IDE Cable
- TC-USB3-18 USB3 Cable
- TC3-22-18 SATA Power / Signal Cable Extender (Male to Female)
- TC7-9-9 9 to 9 Pin Firewire Cable
- 9 to 6 Pin Firewire Adapter
- Quick Start Guide
- Velcro Cable Wraps