David, can you indicate how much slower you found the the Tableau USB blocker. If a image would normally take an hour, how much longer was it with the Tableau?
My first choice is the Tableau USB write blocker but in the event the USB device is not recognised or detected by the tableau I use the software write blocker but always test with my own USB device every time 1st that it can't be written to before using it on any evidence. But for the same reason as Rich2005 I always try the hardware write blocker first.
I also think it's nice to have a physical little black box that, if required, can be handed around the jury or even tested by the defence. If it becomes a big issue (always looking at worst case scenario) you have the expertise of the manufacturers to back you up.
It's not that big a cost in the scheme of things
Good evening,
Unfortunately, the performance data is no longer available to me, but here is my original post to the CCE list on the subject
"I tried imaging a LaCie Hi-Speed USB 2.0 drive using a Tableau Forensic USB Bridge and EnCase 6.12 today. The estimated time to complete 500GB was in excess of 24 hours. I had the same result on two laptops running XP, an Intel Mac running XP, and a desktop Windows 2003 Server system. In some cases, Windows reported that the device was running at USB 1.1 speeds. Other USB 2.0 devices ran at full speed on the same port and the same Tableau ran at full speed with other drives attached.
The LaCie drive connected via a software write blocker, eliminating the Tableau, produced an 8 hour estimated time to completion.
The Tableau with the questionable drive connected to a Firewire port on two different systems produced an estimated time was around 20 hours.
I tried two other Tableau's and checked to see that the firmware was up to date. No effect on the speed.
It appears that the Tableau to LaCie connection is running well below optimum speed."
I then posted
"Tableau denies any reports of problems with this combination. Several other people reported similar problems with a variety of drives. We can reliably recreate the problem. Tableau acknowledged that the device was designed for low capacity USB devices and their recommendation is in line with many people's - use something other than USB.
Putting a powered hub between the drive and the Tableau didn't help. The drive in question has external power, but it was still worth trying.
We couldn't crack the case as it was a client's drive that needed to be returned. There was no way to gain physical access to anything other than the USB port."
-David