Writeblocker recomm...
 
Notifications
Clear all

Writeblocker recommendations

8 Posts
5 Users
0 Reactions
4,090 Views
(@rich2005)
Posts: 537
Honorable Member
Topic starter
 

I'm considering buying a few writeblockers to upgrade our lab, and just wondered if anyone has any views on whether there's anything better in terms of performance/value/reliability (or features - at a comparable price) than the Tableau T35u.

Primarily talking about SATA write-blockers in this instance (or SATA+other).

 
Posted : 25/02/2021 6:36 pm
(@thepm)
Posts: 253
Reputable Member
 

I've always been a fan of Tableau devices. A couple of years ago, I tested the WiebeTech / CRU Ultradock writeblockers (I believe it was the V5). It worked well, but one thing I did not like was that when acquiring a drive using the writeblocker, the drive serial number recorded in the acquisition log file was the serial number of the writeblocker, not of the source drive. 

As I said, that was a couple of years ago and maybe it has been fixed since.

Otherwise, I've only used Tableau devices.

PM

 
Posted : 25/02/2021 10:46 pm
 dega
(@dega)
Posts: 263
Reputable Member
 

@thepm which model of wiebetech? Thanks

 
Posted : 26/02/2021 11:03 am
(@thepm)
Posts: 253
Reputable Member
 

If I remember correctly, it was the Ultradock 5.

 
Posted : 26/02/2021 9:08 pm
 dega
(@dega)
Posts: 263
Reputable Member
 

ok many thanks

 
Posted : 27/02/2021 1:07 am
AmNe5iA
(@amne5ia)
Posts: 173
Estimable Member
 

The T35u is fine but I have had problems with the USB 3 connection dropping out when trying to image SATA disks with problematic sectors.  I've found that if there are multiple read errors from a SATA disk the USB3 connection gets reset and the acquisition fails.  With SATA disks I prefer a SATA connection also from the Forensic Bridge to the computers motherboard.  I use and would recommend the WeibeTech Forensic Labdock U5 for that reason alone.

 
Posted : 01/03/2021 12:46 pm
(@rich2005)
Posts: 537
Honorable Member
Topic starter
 
Posted by: @amne5ia

The T35u is fine but I have had problems with the USB 3 connection dropping out when trying to image SATA disks with problematic sectors.  I've found that if there are multiple read errors from a SATA disk the USB3 connection gets reset and the acquisition fails.  With SATA disks I prefer a SATA connection also from the Forensic Bridge to the computers motherboard.  I use and would recommend the WeibeTech Forensic Labdock U5 for that reason alone.

Interesting you say that.

I've never been entirely confident in USB myself, having the occasional dropout, or difficulty with it, on various machines over the years.

I do prefer having a blocker you can move from machine to machine, or take with you, but a direct sata host connection would be nice. More food for thought!

Perhaps a couple of these and 1 Tableau for versatility 😉

 

 
Posted : 01/03/2021 6:24 pm
(@tecleo)
Posts: 8
Active Member
 

Alternative write blocker options:

1) PC-3000 Portable - https://www.acelaboratory.com/pc-3000-portable-iii-systems.php#digital_forensics

Cons:

  • Pricey – But, what you pay is what you get

Pros:

  • Portable – Standalone + connected to a PC/Laptop
  • Fast – up to 490 MB/s
  • Can be used for forensic imaging + firmware repairs on: SATA/PATA/USB HDD, SATA/PCIe (M.2 NVMe/AHCI, Apple SSD, PCIe x16) SSD, RAID, logically damaged USB Flash drives, SD/mSD cards.
  • Image devices with bad sectors or other read issues.
  • Reports - View, save and print reports on the condition of the devices etc.
  • Multi-device – clone up to three drives simultaneously
  • Excellent support

 

2) SAFE Block - https://www.forensicsoft.com/products/safe-block

Pros:

  • Affordable
  • Portable – Using Windows 10 to go USB drive

Cons:

  • Licence dedicated to one device
  • Initial setup - But, can be very useful in some scenarios, e.g. built-in SSD’s using a bootable USB drive.
This post was modified 3 years ago 3 times by Tecleo
 
Posted : 02/03/2021 9:17 am
Share: