WiebetechUSB Write ...
 
Notifications
Clear all

WiebetechUSB Write blocker and Windows 7

cbrown509
(@cbrown509)
New Member

I have been doing a lot of testing with the Wiebetech USB write blocker v5.5. It would appear that using it with WINDOWS 7 is unreliable.
I have a disk that for iso17025 purposes i have created 5 known bad sectors.
When used with Windows 7 it fails to image properly and reports many disk errors.
If I use the same disk with Windows 8.1 it happily images and gives the expected hash values and known bad sectors.
Anyone else had problems like this?
Chris

Quote
Topic starter Posted : 11/04/2017 10:28 pm
JimC
 JimC
(@jimc)
Member

Please can I ask how you marked the "bad" sectors?

Jim

www.binarymarkup.com

ReplyQuote
Posted : 11/04/2017 10:30 pm
cbrown509
(@cbrown509)
New Member

Created bad sectors using e.g.
hdparm –yes-i-know-what-i-am-doing –make-bad-sector 123435 /dev/sda
(after having created the reference drive in a linux environment using cal-drive.csh)

ReplyQuote
Topic starter Posted : 11/04/2017 10:40 pm
athulin
(@athulin)
Community Legend

When used with Windows 7 it fails to image properly and reports many disk errors.
If I use the same disk with Windows 8.1 it happily images and gives the expected hash values and known bad sectors.

And what is the disk in question, more exactly? Is there any manufacturer's testing software for it? If there is, what does it say - on Windows 7?

There seems to be some caveats about hdparam used on USB drives, if I read the man page correctly. Have they been taken into account?

In order to narrow the interpretation of the test results down, you seem to need to figure out what happens with the disk, on Windows 7, without a disk blocker. Do you get the same result, or a different result?

ReplyQuote
Posted : 11/04/2017 11:25 pm
jaclaz
(@jaclaz)
Community Legend

Also, "it fails to image" under Windows 7 using EXACTLY which tool/program (and with parameters/options? ?

There a few possibly related threads here (related to known issues with large sectored disks, and GPT ones)
http//www.forensicfocus.com/Forums/viewtopic/t=12687/
http//www.forensicfocus.com/Forums/viewtopic/t=11431/

jaclaz

ReplyQuote
Posted : 11/04/2017 11:42 pm
thefuf
(@thefuf)
Active Member

When used with Windows 7 it fails to image properly and reports many disk errors.
If I use the same disk with Windows 8.1 it happily images and gives the expected hash values and known bad sectors.

Sounds like a problem with an operating system and/or an imaging tool. What tool did you use? Is it possible for you to run USBPcap during the acquisition in order to capture USB commands and replies? This would give enough data to identify the problem.

Anyone else had problems like this?

Yes, with Tableau forensic bridges. But that was a firmware problem that blocked any host (with any operating system running) from reading data adjacent to a bad sector (so a single bad sector on a source drive will result in 128 bad sectors reported to a host).

ReplyQuote
Posted : 12/04/2017 12:18 am
cbrown509
(@cbrown509)
New Member

Many thanks for the replies.
The creation of the disk was under the guidance of a couple of guys working nearby who are far more switched on with Linux then me.
I have tried imaging using Encase 8, FTK 3.4 and X-Ways, all with the same result, so I am fairly confident it is not the fault of the imaging tool.

ReplyQuote
Topic starter Posted : 12/04/2017 12:28 pm
jaclaz
(@jaclaz)
Community Legend

The creation of the disk was under the guidance of a couple of guys working nearby who are far more switched on with Linux then me.

Well, you didn't actually "create" a disk I believe, you anyway "messed up" a few sectors of an existing disk, the physical device or "mass storage device" as described here
https://www.cfreds.nist.gov/v2/Procedure_to_create_a_reference_drive.html

Which EXACT make/model is that disk (physical device)?
Is it 512 bytes/sector or 4096 bytes/sector?

jaclaz

ReplyQuote
Posted : 12/04/2017 11:32 pm
cbrown509
(@cbrown509)
New Member

Nothing to do with how the disk was either created or messed up.
It would appear that v5.5 of the Wiebetech Ultradock does not work consistently with Windows 7.
I have had cases where a suspect's hard drive has failed to image via v5.5 but when it has been tried using the Ultradock v5 it imaged fine, identifying some bad sectors on the drive, and also later on to offer up some crucial evidence.
I have contacted CRU by telephone (emails were ignored) who can offer no fix.
This is merely a shout out to those who are considering buying the Wiebetech Ultradock v5.5,
Upgrading the imaging stations to Windows 10 has proved to be the way forward.

ReplyQuote
Topic starter Posted : 20/04/2017 2:27 pm
jaclaz
(@jaclaz)
Community Legend

Nothing to do with how the disk was either created or messed up.
It would appear that v5.5 of the Wiebetech Ultradock does not work consistently with Windows 7.
I have had cases where a suspect's hard drive has failed to image via v5.5 but when it has been tried using the Ultradock v5 it imaged fine, identifying some bad sectors on the drive, and also later on to offer up some crucial evidence.
I have contacted CRU by telephone (emails were ignored) who can offer no fix.
This is merely a shout out to those who are considering buying the Wiebetech Ultradock v5.5,
Upgrading the imaging stations to Windows 10 has proved to be the way forward.

I understand that ) , but I was trying to figure out if there was a definite "pattern", in the mentioned threads it was found that the issues came in some combination of large sectored disks (or however large, 2 tb or more) disks, and/or where GPT is involved, possibly partitioned/formatted under a later OS version than 7.

What I mean is that Windows 7 has been used on a large number of machines for years, and the good Wiebetech guys must have tested the v5.5 with it extensively, and presumably a large number of users have used the OS with that model, so it would be queer that it doesn't behave consistently "at random", there must be some conditions that "trigger" the issue and understanding which these conditions are would have been interesting.

jaclaz

ReplyQuote
Posted : 20/04/2017 2:52 pm
Share: