OPENTEXT Tableau Forensic TX1 - Pcie Firewire Adapter (TDA7-9); Apple Target Disk Mode Acquisition Adapters

5.3 PCIe FireWire adapter (TDA7‒9)
The PCIe FireWire adapter (TDA7-9) enables the acquisition of FireWire drives via
the TX1's PCIe source port. The PCIe FireWire adapter kit (sold as an add-on to the
TX1 kit) includes 9-pin and 6-pin FireWire adapter cables which are used to connect
the FireWire media to the adapter. The PCIe cable used to connect the adapter to
TX1 is included with the TX1 kit.
Note that this adapter was originally created to replace the T9 Forensic FireWire
bridge. TX1 has a native FireWire port which makes this particular PCIe adapter
only useful in cases where many FireWire drives need to be acquired.
Note: There is a 9-pin 1394b port and a 6-pin 1394a port on TDA7-9. If media
are attached to both FireWire ports of the adapter, both will show as available
drives in the TX1 user interface, which will allow for both to be used
simultaneously for any available drive actions (imaging, hashing, etc.).
5.4 Apple Target Disk Mode acquisition adapters
TX1 is designed to acquire Apple computers that support Target Disk Mode. This
can be done via three different Apple computer connection interfaces: USB-C,
FireWire, and Thunderbolt 2. Depending on the Apple computer interface
connection, different adapters and/or cables are required to allow for connection to
the source side of TX1.
Note: Beginning in December, 2017, some Apple devices started using a new
secure enclave interface to their integrated SSDs, which has created challenges
for forensic examiners. The core of the secure enclave interface is the T2 chip,
which sits between the internal memory devices and anything that needs
access to that memory. When provided with the proper credentials using
proprietary Apple interface commands, the T2 chip will unlock the encrypted
data and make it available to the requestor. However, without the proper
credentials or without a mechanism to provide the proper credentials to the
Apple device, the exposed memory will be encrypted. As of this writing,
Tableau devices do not support the special mechanisms to expose Apple
memory devices protected by a T2 chip, nor a way of providing credentials to
enable acquisition of the unencrypted data. The Tableau development team is
actively pursuing support for this scenario, and a future update that provides
such support will be announced as soon as it is available.
5.3. PCIe FireWire adapter (TDA7‒9)
ISTX240300-UGD-EN-1
User Guide
199