Forensic Hardware A...
 
Notifications
Clear all

Forensic Hardware Advice

2 Posts
2 Users
0 Likes
3,797 Views
Dimustrace
(@dimustrace)
Posts: 1
New Member
Topic starter
 

I'm looking for some potential advice.  I work in an environment where we use a Tableau T356789iu Forensic Bridge to copy data from a USB3 encrypted external hard disk of one classification to a hard disk installed in a PC of another classification.  The bridge is required to ensure nothing written back to the USB3 drive so it may be used on it's original system without fear of data contamination.  The process is slow through the bridge, and I'm lucky is I see speeds in excess of 20MB/sec in my transfers.  I'm still working with Tableau to see if I can up the transfer speeds since I can't get the firmware updater to detect the bridge.  But unless anyone has a grand idea to try, this isn't my question.

My question is this: Connecting the bridge to a machine and transferring data is tedious, because I have to repeat this process many times.  What I would like to explore is the ability to read from a single USB3 external drive and be able to have it write to multiple machines.  Just like a USB3 hub, but with a Forensic bridge in-between blocking writing back to the source drive.  I haven't seen such a beast in my travels and wondered if anybody knew of something of this ilk.  Unfortunately, my process can't change much because (as many are probably painfully aware) the process is dictated by an Authority To Operate (ATO), and because of the multiple classifications involved, the general process of not contaminating the source drive must remain intact.  I know at some point my read speeds would become a bottleneck, but as of right now my read speeds outstrip my write speeds by > 10-1.

Just for clarity, I have several of the setups I described but a limited number of USB3 source drives and the intention is to keep those source drives to a minimum number, as maintaining those is also extremely tedious.  Also, in case you're wondering, the T356789iu is an internal hardware device, so I have not been able to test putting a USB port multiplier onto the destination side of the bridge.

Anyone have any suggestions?

 
Posted : 03/03/2021 2:17 pm
Passmark
(@passmark)
Posts: 376
Reputable Member
 

What I would like to explore is the ability to read from a single USB3 external drive and be able to have it write to multiple machines.

Maybe ImageUSB ?

Do you really mean multiple machines? i.e. multiple different computers at the same time, connected via a LAN or the internet?

Or do you really mean multiple destination devices, e.g multiple destination USB drives, all connected to the same machine via a USB hub?

Is the data being decrypted / re-encrypted as it is being transferred? If the data is never decrypted, then it is very hard to image how any copy process could change the source data. Do you really need to be concerned about using a "bridge".

 

 

 
Posted : 03/05/2021 4:09 am
Share: