Volume FORENSIC COMPUTERS Tableau T35i SATA/IDE Bridge USER GUIDE
FORENSIC C OMPUTERS RESEARC H AND D EVELOPMENT Forensic Write Protection Guide 2007 Forensic Computers, Inc. 110 Forensic Lane, Glen Lyn, VA 24093 Phone 540.726.9530 • Fax 540.726.9530 Apple, Mac, Macintosh, and Power Macintosh are trademarks of Apple Computer Inc., registered in the United States and other countries. Microsoft, MS-DOS, Windows, and Windows NT are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.
Table of Contents C H A P T E R 1 Tableau T35i SATA/IDE Bridge 4 Tableau IDE Ribbon Cable 4 8” Red SATA Flat Cable 4 Female to Female Molex® Power Cables (6” or 12”) 4 SATA 15-pin to Female Molex® Power Cable 4 Tableau 1.8 IDE Notebook Adapter 4 Tableau 2.
1 Chapter Tableau T35i SATA/IDE Bridge T he T35i is designed to mount directly in a forensic workstation. Internally the T35i connects to the workstation through a high-performance FireWire800 connection. Externally, the T35i can be connected to SATA or IDE hard disks one at a time for write-blocked forensic acquistions. Contents In the T35i SATA/IDE bridge there are three categories of items that make up the system: the T35i SATA/IDE bridge, the cables and the adapters.
Tableau T35i SATA/IDE Bridge The T335 is designed to be mounted in a 5.25" half-height drive bay on the front of a forensic workstation or tower. The T335 is specifically designed to work in conjunction with SATA and IDE removable drive trays, which should be mounted in close proximity to the T335 in the host computer. (PN: T335) Tableau IDE Ribbon Cable The TC6-8 IDE ribbon cable is a high-quality, 80-conductor IDE cable with standard high-density 40-pin IDE connectors at each end.
Tableau 2.5 IDE Notebook Adapter The Tableau 2.5 IDE Hard Disk adapter allows the user to connect to a 2.5 IDE Notebook hard drive to a 40-pin IDE cable. The Tableau 2.5 IDE Hard Disk adapter also has a 44-pin female laptop drive connector and a 4-pin standard Molex® power connection.
2 Chapter Tableau T35i SATA/IDE Bridge T ableau's newest OEM product, the T35i, continues Tableau's heritage of industry leading innovation. The T35i offers an economical, high-performance alternative to the T345 for forensics professionals whose acquisition needs focus on IDE and SATA subject drives. The T35i is designed to mount directly in a forensic workstation. Internally the T35i connects to the workstation through a high-performance FireWire800 connection.
INTRODUCTION This document provides technical information for the Tableau T35i combination Forensic SATA/IDE Bridge. The T35i combines two separate forensic bridges (IDE, and SATA) into one convenient package while providing native support for each hard disk technology. The T35i is designed to be installed permanently in the front of a forensic workstation or tower which has an open 5.25" half-height drive bay. The T35i connects to the host computer through a FireWire800 (1394B) interface.
SATA Det LED The SATA Det LED (SATA Detect) illuminates when a hard disk attached to the SATA interface connector has been properly recognized. Only one hard disk may be connected to the T35i at a time. IDE Det LED The IDE Det LED (IDE Detect) illuminates when a hard disk attached to the IDE interface connector has been properly recognized. Only one hard disk may be connected to the T35i at a time.
The following table describes each of the elements shown in the above picture. Internal Element 1394B (FireWire 800) DIP Switch Bank Power Description The T35i must be connected to the host computer via a FireWire800/1394B connection. This is the interface through which each of the T35i's two I/O channels will communicate with the host computer. It is acceptable to use FireWire400/1394A instead (with an appropriate cable adapter), but performance will be reduced.
IMPORTANT: Tableau strongly recommends that the T35i be on a dedicated power supply lead. Switching the T35i on/off can lead to large current/voltage surges which can interrupt the operation of other devices which share a power supply connection with the T35i. CONFIGURATION SWITCHES The following table summarizes the function of the four position DIP switch. Operation Switch Switch OFF Switch ON 1 Bridge operates in forced READ-ONLY Bridge operates in READ-WRITE mode.
Windows ME/98se Other ON OFF OFF OFF READ-WRITE mode (even though it is not), and Windows 2000 will successfully mount NTFS volumes. Windows ME/98se may not recognize that a bridge is READ-ONLY and may attempt to write to the bridge anyway. If this happens, Windows ME/98se will generate a "blue screen" error. The recommended settings to the left eliminate the "blue screen" error. NOTE: Some forensic users prefer to see the Windows "blue screen" error if a write is attempted.
Glossary A ATA – AT Attachment is a standard interface for connecting storage devices such as hard disks and CD-ROM drives inside of personal computers. B C D DIN- the abbreviated name of the German Institute for Standardization (Deutches Institut fur Normung) and is used in the names of its standards. There are a variety of DIN connectors in existence today. The one mentioned in this text is a 5-pin DIN connector.
iPOD – a brand of portable media players designed and marketed by Apple Computer. J K L M Molex® - A type of power connection used the computer industry, which has a plastic end attached to four wires: one yellow (12V), one red (5V) and two black (ground). There are female and male Molex® connectors. N O P Q R S SATA – is a traditional dish from the Malaysian state of Terenngganu, consisting of spiced fish meat wrapped in banana leaves and cooked on a grill.
NOTES 14
