External hard drive...
 
Notifications
Clear all

External hard drive eSATA vs USB

8 Posts
6 Users
0 Likes
700 Views
(@dndschultz)
Posts: 24
Eminent Member
Topic starter
 

I am attempting to image a 4 TB external hard drive with a Tableau T35es forensic bridge. I removed the hard drive from the external case and attempted to acquire via eSATA with the T35es. It would only recognize the physical drive with Unused Disk Area. However, when I connect through the external hard drive case via the USB I get logical file system. I have 70 TB of imaging to do and the USB is too slow. Does anyone know why I cannot get the logical file structure using the eSATA connection? I have updated the Tableau Firmware.

 
Posted : 17/10/2014 8:37 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

I am attempting to image a 4 TB external hard drive with a Tableau T35es forensic bridge. I removed the hard drive from the external case and attempted to acquire via eSATA with the T35es. It would only recognize the physical drive with Unused Disk Area. However, when I connect through the external hard drive case via the USB I get logical file system. I have 70 TB of imaging to do and the USB is too slow. Does anyone know why I cannot get the logical file structure using the eSATA connection? I have updated the Tableau Firmware.

Absolutely NOT an answer to your question ( , but isn't your main goal to make an image of the physical disk?

Or does the Tableau thingy only show the unallocated space of the physical disk? ?

Or is there an issue with the actual size of the disk that *somehow* is "mitigated" or "corrected" when using the USB bridge inside the original external case of the disk?
(like a sector size translation or some form of authentication/decrypting or some form of "skipping reserved areas")

I mean can't you dd the first (say) 10000 sectors of the "physical disk" as seen through the e-Sata connection, dd the same amount of sectors from the "physical disk" as seen through the USB connection, and verify they are exactly the same?

Or, alternatively, can you post some actual details?
Mainly which EXACT hard disk AND EXACT USB external case is it and which OS are you using?

jaclaz

 
Posted : 17/10/2014 9:35 pm
(@athulin)
Posts: 1156
Noble Member
 

I removed the hard drive from the external case and attempted to acquire via eSATA with the T35es. It would only recognize the physical drive with Unused Disk Area. However, when I connect through the external hard drive case via the USB I get logical file system.

What recognized 'Unused Disk Area'? the Tableau? Some product you haven't told us about?

And what exact product are you imaging? It matters, you know.

Did you look at sector 0 when the hard disk was out of the case? Compare it with sector 0 when it's in the case? Did you examine the hard disk configuration – I'm wondering particularly about ATA security options?

Sounds to me as if the hard disk won't work as expected unless it's mounted in its case. If that's the case, you don't have a lot of alternatives …

 
Posted : 17/10/2014 11:04 pm
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

hardware locked/encrypted drive?

I seem to recall some of the WD drives are like this, outside of the case you can only see the physical drive as unallocated space, but inside the enclosure you see the partition only.

Assuming the partition size matches the whole disk size then you potentially are only missing out on unpartitioned space if you image this way.

You said you have 70TB of imaging to do so I assume you have about 15 of these devices?

You may be in for a long haul, unless you can get several going at a time on different work stations.

 
Posted : 21/10/2014 10:35 am
(@kbertens)
Posts: 88
Trusted Member
 

If its indeed a WD external harddisk, it has encryption build into the USB-SATA controller inside the case (not controller on the HD).
You could try to find a similar WD case with usb3/esata support and try to image the disks with that case.

 
Posted : 21/10/2014 5:08 pm
(@dndschultz)
Posts: 24
Eminent Member
Topic starter
 

The Tableau write blocker is only reading 3.8 GB of unused disk area that is all h00. It is not seeing anything else. When I originally hooked the drive up to a T8 USB bridge I could see a write protected Drive #9 with a logical volume “I.” When I took apart the external drive case and hooked it up via eSATA using T35es-R2 write blocker it would only see drive 9 with 3.8 GB of unused disk area. Disk management also shows it as an uninitialized disk.

I will try and put it back in the case and let you know if that does the trick. Does the case have some sort of a controller card or something?

 
Posted : 22/10/2014 6:21 am
(@dandaman_24)
Posts: 172
Estimable Member
 

When imaging a WD external HD, ensure you download the WD software and image the HD within the case it was supplied in.

 
Posted : 22/10/2014 12:48 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Does the case have some sort of a controller card or something?

It depends on the actual EXACT make/model of BOTH case and actual hard disk (something that you haven't yet detailed).

As posted before some (but NOT *all*) Western Digital have a "custom" controller in the case (actually in the SATA-USB bridge) with hardware encryption, but the same may happen with other brands, typically the hard disk is "standard" but the controller in the case encrypts (and decrypts) data on-the-fly.

jaclaz

 
Posted : 22/10/2014 10:29 pm
Share: