USB drives can report separate serial numbers as a USB device and as a SCSI storage device. Tableau Forensic Bridges (T8u, T356789iu, etc.) present the evidence drive’s SCSI storage device serial number to the host. However, the Tableau Forensic Bridges must present their own unique USB device information (including serial number) on the host interface to be identified by software like Tableau Firmware Update and TIM. TIM and Tableau Forensic Bridge firmware have both been updated to communicate the evidence drive’s USB device serial number. With these updates in place, TIM will display the evidence drive’s USB device serial number in the user interface and in forensic logs. [TBL-3485]
Enhancements
Minor user interface updates (OpenText rebranding and copyright date change). [TBL-3988][TBL-4045]
Issues fixed
Forensic logs for acquisition jobs done from AHCI based PCIe source media do not include HPA/DCO/AMA information. [TBL-4010]
When used with a T356789iu bridge, TIM reports the bridge's model number as T356789. [TBL-3842]
TIM installation may fail due to issues with mismatched versions of the Windows Visual C++ Runtime library. [TBL-3822]
USB source media that does not report a SCSI layer serial number will show non-ascii characters in the serial number field of TIM's Device Information screen. [TBL-3336]
TIM 1.3
New features
Addressable Max Address (AMA) is a new type of drive size limitation, similar to HPA/DCO, which was specified in the ATA/ATAPI Command Set 3 (ACS-3) specification. TIM now supports the ability to detect and remove AMA settings when used in conjunction with Tableau Bridges with version 2.1 firmware or later. [TBL-3059]
Enhancements
Hashing performance has been improved, enabling faster imaging speeds. [TBL-1373]
Imaging source media with errors is now significantly faster. [TBL-1591]
E01 image files created by TIM now reflect the TIM version in use when the files were created (for example, “TIM 1.3”), and include the SHA1 hash value. [TBL-3293]
TIM can run multiple jobs in parallel when used with Tableau Bridges that support multi-LUN export. However, depending on the disparity in the read speeds of the source drives, it may not be faster than imaging the drives sequentially. TIM will now alert the user when a parallel imaging situation is being requested to ensure that is the desired behavior. [TBL-1217]
Issues fixed
Using the default image file name will result in an error message claiming the name is invalid. [TBL-1477]
TIM 1.2.1
Innovative, real-time acquisition graphics
Ability to schedule jobs for sequential or simultaneous imaging
Support for Encase .E01, .DD, or .DMG output file formats
User selectable .E01 compression levels
Ability to customize destination path and file name conventions by using user-specified strings and/or variables such as date + time, subject drive serial number, and model number
Advanced error recovery and reporting
Calculation of MD5 and SHA-1 hash values
Image job, HDD, and write blocker information (for reporting and archival)