Tableau have released their Tableau high performance software imaging product today.
To install it you first must have installed the latest Tableau firmware updater. Once installed the interface is fairly simple to use. I found some of the terminology in the GUI a bit odd. For example the types of compression selectable for Encase e.01 files are No Compression, Fast Compression or Good Compression whilst Encase provides the options none, good or best. It seems that fast maps to good and good maps to best. There also does not seem to be the ability to actually name the created e.01 files- just their containing folders, again a little strange.
Now as far as performance is concerned in our environment it is slightly faster. We image to a mapped network drive on a san across a gigabit ethernet network. I imaged a Hitachi 80GB sata laptop hard disk via a Tableau T35i write blocker using FTK Imager 2.5.5 using the Encase e.01 format - imaging completed in 51 minutes. Using TIM to image the same drive took 44 minutes. In both cases maximum compression was selected. Obviously at this stage this testing is far from scientific but TIM seems to be between 10 to 15% faster. I will report how it goes on with larger 3.5 inch sata hard drives later.
Posts
4 comments:
That's great that there's a noticable speed increase, but it always makes me a little suspicious when things like this occur. Why should TIM be any faster than say FTK Imager? Does TIM whisper a secret password into the Tableau device to get it to try extra hard?!
I know, I know, optimised code, they know the little quirks of the hardware, blah, blah, blah, but is it not just comms over a USB cable?!
I did a quick test with TIM and I like the result. IF theres a interest I could upload a PDF.
/Rob from Sweden
Hi Richard,
I've just installed TIM and had a quick look at the GUI.
Most posts that I've seen have mentioned that it is quicker than other imagers, however am I right when I noticed that you only have the option of creating the image file as Image.E01.
I use the exhibit reference to identify the image file and so having several images imported into a case all called Image.E01 sounds a bit confusing to me.
Do you know whether it uses the ewf file format and if so does the MD5 value match in both FTK and TIM?
Jim
I have run a number of tests and found that TIM is way faster than EnCase (but then what isn't?) TIM was fast but it wasn't always that fast and it wasn't always the fastest. That TIM is only marginally faster than some tools and really only effective with Tableau WB/s very much limits its usefulness to me.
Post a Comment