Tableau and WikiLeaks

Previously Tableau had allowed thea visualization of the Wikileaks data to appear on their Tableau Public site, this was not the actual emails and documents, but merely a visualization of the data – Tableau Public is a bit like YouTube for data visualization.

However, much liks Amazon, PayPal, and other companies they soon pulled the data from their site ( at the end of 2010).

As a result many people were not happy about this, lots of complaints and accusations about government collaboration, etc.

Below is the formal statement by Tableau on the reasons for the data being taken down.

Wednesday afternoon, Tableau Software removed data visualizations published by WikiLeaks to Tableau Public. We understand this is a sensitive issue and want to assure the public and our users that this was not an easy decision, nor one that we took lightly.

We created Tableau Public—a free service that enables anyone to make interactive graphs from their data and share them online—because we recognized the need for strong analytics tools in a data-driven world. Given the controversy around the WikiLeaks data, we’ve closely followed the debate about who actually has the rights to the leaked data.

Our terms of service require that people using Tableau Public do not upload, post, email, transmit or otherwise make available any content that they do not have the right to make available. Furthermore, if we receive a complaint about a particular set of data, we retain the right to investigate the situation and remove any offending data, if necessary.

Our decision to remove the data from our servers came in response to a public request by Senator Joe Lieberman, who chairs the Senate Homeland Security Committee, when he called for organizations hosting WikiLeaks to terminate their relationship with the website.

This will inevitably be met with mixed reaction. However, our terms of service were created to ensure responsible use of data.

Tableau Software 6.0

Tableau Software‘s just-released 6.0 version may prove to be one of the company’s biggest releases and one that heightens the business intelligence competition with QlikTech, Tibco Spotfire, and Microsoft PowerPivot.

Tableau previewed its latest release in my “Cool BI” class at The Data Warehousing Institute (TDWI) World Congress in Orlando earlier this month. As I wrote in a recent in-depth review, Tableau’s visual discovery tool is one of the easiest to use.

With Tableau 6.0, customers seem to get the best of both worlds. Tableau’s new Data Engine leverages the source database when necessary, or it can bring portions of the data into memory when that offers better performance. Adding support for Windows 64-bit operating environments improves the product’s scalability.

Read More….

Forensics: Tableau Cloner

Tableau, best known for their write blockers also make a cloner; the Tableau TD1 Forensic Duplicator.

It can handle S-ATA or IDE,  and can clone or produce an image file and it can deal with HPA or DCO on hard drives, and has a transfer rate of up to 6 GB/minute. Its basics operation its comparable to the Logicube or the ICS productions, but that is where the

Tableau TD1

comparison ends. Both ICS and Logicubes products have more features, from USB imaging and dual hard drive cloning, to keyword searching and logging on external media.

While Logicube are on their 6th generation of cloners Tableau are on their first generation, so it would be expected that Tableau’s first cloner would not be the same at Logicbues 6th. Tableau’s future releases will probably be far richer in capbility and features.

Forensics: Examing USB Drives

When conducting a computer forensics investigation on a USB thumb drives, in addition imaging the drive, it is recommended that the PID and Serial numbers from the USB drive are obtained, particularly for those civil sector.

The reason is that those involved in the civil sector often image/collect the data at the scene and then have to return the original source media, leaving with only the images.

With hard drives, CDs, etc, this is not a problem, because an image obtains all of the data required, however with a USB drive this “may” not be the case.

A USB drive, the actual hardware, contains the serial number/PID of the device, which is not captured on the image.

This information can be important if the investigator is trying to prove that a particular USB drive was connected to a computer as the the serial number/PID of the USB drive is written the registry and Setupapi.log of the computer it is connected. If this information is not obtained from the USB thumb drive, at the time collection,  this information may never be available again.[The USB drive could be lost, destroyed, or access refused].

If the USB Serial Numbers/PID are not available it may not be possible to prove a sequence of events, this is particularly important for data theft investigations.

Software tools are able to pull this information out of the USB drive, but this requires connecting a USB drive directly to a computer, which may not be feasible. Tableau’s hardware write blocker, the T8,  for USBs, has the ability to display all of the information required.

Tableau USB Write Blocker

Forensics: e-SATA Write Blocker – just got faster

The Tableau e-SATA write blocker has, according to Tableau, just got faster with the release of new drivers. Their press release states:

Effective immediately, Tableau announces the release of Tableau Firmware Update (TFU) v6.30, available for download at www.tableau.com/tfu .  TFU v6.30 increases the SATA to eSATA transfer speed of all T35es write-blockers. Performance increases as much as 34% were recorded during quality assurance tests completed by Tableau technicians using DCFLDD, FTK Imager, and EnCase imaging applications.

TFU v6.30 is available as a free download to all registered Tableau forensic bridge owners. For more information on this and other firmware releases, please see the Tableau Firmware Update Revision History on-line.