Connecting a USB flash memory to a WiebeTech ComboDock

Definitely test out your theory on an irrelevant source before trying your process on live evidence. I am stating the obvious, I am sure.

If I bought an adapter from USB to SATA, would I be able to write-block the memory flash and use it write-blocked?

No, not likely.

If you find an adapter that allows you to connect a USB flash drive to a SATA interface, please share the link? I've never seen one.

If I bought an adapter from USB to SATA, would I be able to write-block the memory flash and use it write-blocked?

No, not likely.

If you find an adapter that allows you to connect a USB flash drive to a SATA interface, please share the link? I've never seen one.

Really?

And which would be the solution? Buying another write blocker only for flash memories? D Any advice?

In the official site of the unit it can be read that there are a variety of adapters in case we need to write-block non-SATA or non-IDE drives.

But if you need to work with a non-standard drive there are a variety of adapters available for additional flexibility.

http//www.cru-inc.com/products/wiebetech/wiebetech_forensic_combodock_v5/

Skywalker,

I am confused by your question.

I primarily use Tableau TD2s (www.digitalintelligence.com) for acquisition of USB media (USB thumb drives, external hard drives).

It appears both from the picture on the website and documentation that your Combodock v5 has a write-protected USB port that you can connect original evidence to.

(http//www.cru-inc.com/products/wiebetech/wiebetech_forensic_combodock_v5/)

Host (I/O) Ports FireWire 400 up to 400 Mbps
(1) pair of FireWire 800 up to 800 Mbps
(1) USB 3.0 up to 5 Gbps
(1) eSATA up to 3 Gbps

Why do you need to convert the USB media to SATA?

For a free alternative, try DEFT (www.deftlinux.com) You can easily use Guymager on running in DEFT on a laptop with at least two USB ports to image USB media.

Only a member here (and internationally acknowledged Linux expert) named thefuf can adequately explain the deficiencies of using DEFT's software based write-protection versus a hardware based write-protection, but that fact notwithstanding, DEFT apparently meets the criminal standard of law in Italy, which is good enough for me D

Host (I/O) Ports FireWire 400 up to 400 Mbps
(1) pair of FireWire 800 up to 800 Mbps
(1) USB 3.0 up to 5 Gbps
(1) eSATA up to 3 Gbps

Host ( I/O ) are ports you connect to the investigator's machine, the evidence is connected to the drive side and the drive side only have SATA IDE/PATA connections.

On the Windows side, I prefer using SAFE Block ( http//www.forensicsoft.com/products.php ).

You can also change the registry to give you software write blocking
Enable ( Read only )
[HKLM\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies]
“WriteProtect”=dword00000001

Disable ( Read / Write )
[HKLM\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies]
“WriteProtect”=dword00000000

You can boot from a forensically sound LiveCD and use Linux to provide software write blocking.

In any case, just keep in mind that any NAND based storage media will have its internal wear leveling algorithm that will internally change the storage device by relocating unallocated clusters, so write blocking a USB device may still change the data location and validation may fail. ( My recommendation Make two images of the drive and validate the image against the other copy since validating against the physical drive later on might fail even if you use HW/SW write blocking. )

If I bought an adapter from USB to SATA, would I be able to write-block the memory flash and use it write-blocked?

No, not likely.

If you find an adapter that allows you to connect a USB flash drive to a SATA interface, please share the link? I've never seen one.

Really?

And which would be the solution? Buying another write blocker only for flash memories? D Any advice?

In the official site of the unit it can be read that there are a variety of adapters in case we need to write-block non-SATA or non-IDE drives.

But if you need to work with a non-standard drive there are a variety of adapters available for additional flexibility.

http//www.cru-inc.com/products/wiebetech/wiebetech_forensic_combodock_v5/

Yes, really. I have and use both the Wiebetech ComboDock and UltraDock (as well as comparable Tableau models). The USB3 port on the Wiebetech devices connects to the imaging computer, not the source drive. The adapters Wiebetech talks about are for drives with a different form factor but that still implement SATA (e.g., miniSATA, uSATA) or IDE (e.g., 2.5").

If you want a hardware write blocker for USB devices, CRU and Tableau both make dedicated USB write blocking devices, to which you can attach a card reader for flash memory such as SD, uSD, SD, etc., but the Wiebetech ComboDock is not it.

As I said, if you actually discover an adapter like the one you're envisioning, please share the link. I'm not saying it's impossible, just that I've never seen one. If it existed, we (the digital forensics community) would almost certainly know about it.

Skywalker,

I am confused by your question.

I primarily use Tableau TD2s (www.digitalintelligence.com) for acquisition of USB media (USB thumb drives, external hard drives).

It appears both from the picture on the website and documentation that your Combodock v5 has a write-protected USB port that you can connect original evidence to.

(http//www.cru-inc.com/products/wiebetech/wiebetech_forensic_combodock_v5/)

Host (I/O) Ports FireWire 400 up to 400 Mbps
(1) pair of FireWire 800 up to 800 Mbps
(1) USB 3.0 up to 5 Gbps
(1) eSATA up to 3 Gbps

Why do you need to convert the USB media to SATA?

For a free alternative, try DEFT (www.deftlinux.com) You can easily use Guymager on running in DEFT on a laptop with at least two USB ports to image USB media.

Only a member here (and internationally acknowledged Linux expert) named thefuf can adequately explain the deficiencies of using DEFT's software based write-protection versus a hardware based write-protection, but that fact notwithstanding, DEFT apparently meets the criminal standard of law in Italy, which is good enough for me D

Hi UnallocatedClusters,

Zoltandfw is right. In the ComboDock unit, USB is an out interface, not an in one. You can connect the unit to the computer through USB but you cannot connect a USB drive or USB flash memory to the ComboDock in order to write-block it.

If I bought an adapter from USB to SATA, would I be able to write-block the memory flash and use it write-blocked?

No, not likely.

If you find an adapter that allows you to connect a USB flash drive to a SATA interface, please share the link? I've never seen one.

Really?

And which would be the solution? Buying another write blocker only for flash memories? D Any advice?

In the official site of the unit it can be read that there are a variety of adapters in case we need to write-block non-SATA or non-IDE drives.

But if you need to work with a non-standard drive there are a variety of adapters available for additional flexibility.

http//www.cru-inc.com/products/wiebetech/wiebetech_forensic_combodock_v5/

Yes, really. I have and use both the Wiebetech ComboDock and UltraDock (as well as comparable Tableau models). The USB3 port on the Wiebetech devices connects to the imaging computer, not the source drive. The adapters Wiebetech talks about are for drives with a different form factor but that still implement SATA (e.g., miniSATA, uSATA) or IDE (e.g., 2.5").

If you want a hardware write blocker for USB devices, CRU and Tableau both make dedicated USB write blocking devices, to which you can attach a card reader for flash memory such as SD, uSD, SD, etc., but the Wiebetech ComboDock is not it.

As I said, if you actually discover an adapter like the one you're envisioning, please share the link. I'm not saying it's impossible, just that I've never seen one. If it existed, we (the digital forensics community) would almost certainly know about it.

Thanks for your answer, my friend.

What do you think about this one?

http//www.cru-inc.com/products/wiebetech/media_writeblocker/

I promise that if I discover the adapter, I will share it D

Thanks for your answer, my friend.

What do you think about this one?

http//www.cru-inc.com/products/wiebetech/media_writeblocker/

I promise that if I discover the adapter, I will share it D

Thanks. I haven't used that product, but Wiebetech is a respected brand and I have no reason to believe it's not a good one. I haven't looked to see if it has been tested by NIST, etc. Here's the one I own

http//www.cru-inc.com/products/wiebetech/usb_writeblocker/

I just use that with a media adapter to image flash memory cards.

Incidentally, to me, a more important issue is the paucity of USB3 write blockers. Sometimes you're stuck with the choice of imaging at USB2 speed or risking breakage by disassembling a device that is hermetically sealed. Not a great choice.