Good Morning everyone,
I have come across an issue that I am really struggling with. Searches in various Windows forums have failed to come up with a solution so I thought I would ask here.
I have a Win7 Forensic machine. Using both USB and Firewire connected Tableau write blockers to preview both IDE and Sata hard drives.
Though it did work fine in the past, I can no longer see the connected drives in "My Computer". Going to virtual Disk management I can see the read only connected drive with all of its partitions but it has not been allocated a drive letter by Windows. Hence there are some tools that I cannot use.
I can view the disk as normal in Encase, FTK and Tableau imager. Just not in any program that requires a drive letter to be allocated.
If I try to manually allocate a drive letter in Disk manager I cannot as the option is greyed out.
I presume this must be some sort of registry setting but am at a loss as to how to fix it, short of a Win7 Re-Install, which I really want to avoid !
All other directly connected drives and USB sticks all work fine, it just seems to be the ones that are write protected via a tableau (write protected SDcards and HDD's still work fine unless they are connected via a Tableau)
We have 24 SATA/IDE/USB tableaus in the office, they are all acting the same but work fine on other investigators machines.
Has anyone come across this before, can think of a solution before I waste a couple of days building a new machine !
regards
Jerry
Are you logged in with full administrator privileges? Does a network policy override what you can do - can another user logged into your machine do what you want to do?
If I remember correctly there was an issue with some Tableau write-blockers in Windows 7, which they subsequently fixed with a firmware update. Have you updated your write-blocker firmware recently?
Edit I stand corrected - I have just checked and it was ICS DriveLocks we had issues with. Sorry!
we've had all sorts of issues which seemed to stem from having mounting software running whilst connecting a drive. not quite the same issue as you, but worth checking.
I've sometimes lost drives because they conflicted with a mapped network drive.
I have found Tableau to be very good at reading drives - even ones that have physical issues and cannot be read by anything else.
thanks for the suggestions so far …
I have decided to build another forensic machine so this has now become academic, I just hope I don't get a repeat of this ….
Thanks for the efforts though, I will take them into consideration …
JH