Experience Tableau ...
 
Notifications
Clear all

Experience Tableau vs. Wiebe Tech write blocker?

10 Posts
8 Users
0 Likes
766 Views
(@bitstorm)
Posts: 53
Trusted Member
Topic starter
 

I've played around with the Tableau write blocker at university in the lab but found Wiebe Tech Ultra Dock 4 very interesting from view of features. Are there big differences in using such devices or any nogos in special cases. I need it for Win 7, 64 bit locker (OS & Data) and some devices without bit locker, service partition. Software will be dd for acquisition and Testdisk, foremost/ scalpel, sleuthkit/ autopsy for investigation.
As in Encase the Tableau is detectet by software. Is this also the case with the above mentioned tools? Can't test it over here.

Edit/
The difference between both is answered here
http//www.forensicfocus.com/index.php?name=Content&pid=167&page=1

 
Posted : 07/10/2011 2:25 pm
(@kovar)
Posts: 805
Prominent Member
 

Greetings,

I own both, and I use both. EnCase only detects the Tableau, but that's hardly a reason to choose it over the WiebeTech.

I prefer the WiebeTech for field work since it takes up less space.

-David

 
Posted : 07/10/2011 11:28 pm
ntexaminer
(@ntexaminer)
Posts: 49
Eminent Member
 

I also prefer WiebeTech over Tableau. I haven't experienced problems with either, but I like the fact that I can attach SATA or IDE to the same WiebeTech write blocker (whereas I have to use two separate Tableaus). Tableau may have since released a newer version allowing you to do this though.

 
Posted : 26/10/2011 6:36 am
(@bitstorm)
Posts: 53
Trusted Member
Topic starter
 

I think I go ahead with the Tableau. I had a talk with my prof (just applying to a CAS in IT forensic). He has no experience with the Wiebetech, but we talked about the Tableau. In the end I must say I take the Tableau. One reason is to have the same equipment as the big forensic police departments uses over here.

 
Posted : 26/10/2011 11:28 am
 96hz
(@96hz)
Posts: 143
Estimable Member
 

I also prefer WiebeTech over Tableau. I haven't experienced problems with either, but I like the fact that I can attach SATA or IDE to the same WiebeTech write blocker (whereas I have to use two separate Tableaus). Tableau may have since released a newer version allowing you to do this though.

Yes the tableau T35es supports both ide and sata

 
Posted : 11/01/2012 5:21 am
(@athulin)
Posts: 1156
Noble Member
 

Are there big differences in using such devices or any nogos in special cases.

Have you looked at http // www . cftt . nist . gov/hardware_write_block.htm ?

One 'watchout' I have noted from posts here and elsewhere (though not verified personally) is that there may be differences in blocking technique. There are two fundamental ways of approaching write blocking a) block everything that is known to modify the device contents, and let everything else through, and b) block everything, and only let safe commands through.

In the most common use cases, this won't make any difference. But if you are working with a device that has some kind of additional functionality, and that functionality falls in the gap between case a) and b) above, you may have a problem.

The cases where this kind of behaviour is suspected is mainly for USB drives (where there may be password protection implemented by means of unspecified USB commands), where the write blocker in use did not prevent logon attempts to lock-out the device, a situation which was assumed to be impossible to account for with a write blocker present. On U3 platform, for example, device logons are done with commands not specified by the relevant standard. It doesn't seem impossible that a similar situation exists for manufacturer-specific hardware commands on ATA devices.

One thing that write blockers cannot stop is change of power-on counters (which is part of the SMART parameters). There may also be log pages in a HDD that may be affected (see ATA specification) by what the drive does, rather than what commands are being given. Few, if any, imaging tools collect this information, but … sooner or later you may be asked about it.

If you want to be very careful, you may want to verify, for each product, exactly what commands are being blocked or modified at the device protocol level, and evaluate how that affects your particular situation.

 
Posted : 11/01/2012 12:23 pm
(@ryanp)
Posts: 19
Active Member
 

FWIW, I have both and use both. We have (2) WiebeTech's and both failed at various points. I am told that one of the write blockers took out the controller boards on two hard evidence hard drives before the write blocker failure was uncovered. In that situation the WieveTech was being powered from a generator power supply without a UPS filtering power and WiebeTech correctly pointed out that we can't be sure the drives were good when we connected them (of course they were good when they were carried out from running machines out into the waiting forensics truck).

The other WiebeTech spun up the evidence hard drive, but would not communicate with a host computer regardless of interface. Being that they were out of warranty I was prepared to pitch them both in the trash, HOWEVER WiebeTech stepped up and repaired both units under warranty AND did so very quickly. Although we initially had problems, they have earned my respect with their willingness to stand behind their product.

The Tableau's work well, however they are a decent bit more expensive.

 
Posted : 08/02/2012 12:49 am
(@jonathan)
Posts: 878
Prominent Member
 

Are there big differences in using such devices or any nogos in special cases.

Regardless of write-blocker, be aware that SSDs may automatically wipe blocks marked as unallocated at power on.

 
Posted : 08/02/2012 1:22 am
(@pbeardmore)
Posts: 289
Reputable Member
 

Ouch, just bought another Tableau and seen this thread, good to have some competition in this area, will order one tomorrow to try out.

 
Posted : 09/02/2012 4:27 am
(@bitstorm)
Posts: 53
Trusted Member
Topic starter
 

What about Bitlocker with TPM and write blocker? Is there any special thing to do?

 
Posted : 03/04/2012 1:11 pm
Share: