USB Write Blocker recommendation

I have 4 or 5 of the Tableau T8s and have been quite satisfied with them.

Go for the TableAU T8 (I have one for my research work, they are good quality units , and very effective )

Steve

I have the new Wiebetech one and in my testing it's done well. Haven't had a need in a production environment for it yet. I also have a Tableau (model escapes me at the moment) that has worked ok, but sometimes it's difficult to get it to see the device connected to it.

Tom

I have the new Wiebetech one and in my testing it's done well. Haven't had a need in a production environment for it yet.

Would you be so kind to post further results when they come up? We are looking at these but are waiting for some empirical results.

Hello,

I'm discovering computer forensics. Can someone quickly explain the interest of using such device ?

Thanks a lot )

Hello,

I'm discovering computer forensics. Can someone quickly explain the interest of using such device ?

Thanks a lot )

A helpful resource for information as you discover computer forensics is the ForensicsWiki.
http//www.forensicswiki.org
There are pages that will explain items such as write blockers and why they are used
http//www.forensicswiki.org/wiki/Write_Blockers

If you come across a phrase or term you do not understand you should be able to find the information there and then ask more specific questions to the community here.

I have the DI Ultrakit, so the Tableau T8 came included. It works as advertised. Before using it for a real job the first time, I ran a test against it in both Linux and Windows environments and got both the same results, and matching hashes.

The only thing you need to be aware of is that it passes it's own serial number to windows instead of the device serial number. It took me a couple of hours of testing to nail that down. If you need a device serial number to match your device to say a registry entry, use the on-device display and menu to pull the device serial number.

I've been using the Wiebetech usb write-blocker recently. I like it for its simplicity of use, and it's small convenient size.

I've tested it by attempting to copy data to the usb drive while it is connected to the blocker, and then disconnected the drive. I then remount it, and find that those files above don't exist on the write blocked usb drive in question.

I also created an image of the same usb drive and found no files modified, accessed, or created on/at the day/time I tried the above steps.

One thing I would point out is that the Wiebetech has a "Remount" button that you press in order to help the system detect and mount the drive under acquisition, if needed. I've found this to be a reliable feature, but just be mindful of it b/c it will disconnect the drive being acquired should you hit it inadvertantly.

Thought I would post a follow up to his thread. I had originally done my testing and imaging above using FTK Imager. Recently I attempted to use the Wiebetech with Encase to image a drive and came upon some errors.

I'm working with Guidance support on it, and apparently am not the only one experiencing problems with Encase and the Wiebetech.

I'll post any solutions that I receive.