USB's

Although there are similar tools, I use the Tableau T8 Forensic USB Bridge.

Ditto. )

Thanks I'll see if I have a local stockist for the Tableau. Did I once read you can tinker with the registry to stop it from writing to an attached USB, or is that more trouble than its worth.

M2CFG USB WriteBlock software will change the registry for you at click of a button. you can get software from following link and it free.
but so far i haven't got it to work with vista
http//www.m2cfg.com/usb_writeblock.htm

Thanks diesal, will try that tool also.

see here for the UK importer of Tableau write blockers. Solid and reliable piece of kit in my experience.

http//www.dataduplication.co.uk/

Greetings,

I use Tableau and WiebeTech devices in general, and am happy with both. I did discover issues with the USB Tableau write blockers when imaging large external USB drives. The throughput was well below what you'd expect from USB. I changed a lot of parameters and the problem seemed to be with the Tableau. I talked to their tech support and they said that the USB writeblocker was really designed for small devices, not large hard drives. If you want to image a large hard drive, I'd advise getting one of the eSATA Tableau's or a WiebeTech.

-David

If your analysis machine is Windows XP, then I'd suggest going with the software (registry hack) write-block method. In addition to being just as reliable, tested and valid as using a hardware write-block device is for acquiring images of USB devices it also has the benefit of being free and immediately available.

Jeff

I personally like the 'safety net' or 'comfort blanket' of the hardware 😉
Ie, no software process can write to the drive. (I say this as what's to prevent a nasty little virus that wasn't picked up by your antivirus, for example, from writing to that drive without your knowledge. All of these hacks don't fully stop you from writing to the drive do they - last time i checked you could still direct wipe the drive for example with the hacks on.)