Connecting hard drives through a write-blocker

[Dorothy Waugh]

Hi there,

We've been having some trouble connecting hard drives to BitCurator via a write-blocker. We've tried two PC hard drives and a Mac hard drive, all hooked up to our host computer via a Tableau write-blocker. The write-blocker is showing up amongst the USB devices in BitCurator, but it doesn't show up when we try to mount it. We've been able to mount drives without any write-blocker. Are we doing something wrong?

Thank you so much!

Dorothy

Dorothy Waugh

Research Library Fellow, Digital Archives

Manuscript, Archives, and Rare Book Library

Emory University

[Kam Woods]

You mean that when you click on the "Safe Mount" icon in the top, it's not showing up in the list, right?

I think you're running into a bug. If you have a hardware write blocker attached, you can disable the software write blocking (right click on the "Safe Mount" icon, and select "Read/Write" as the mode). You're obviously still write-blocked, because...you're using a hardware write-blocker :).

Now, when you plug your disk in, it should appear in the column on the left, and you should just be able to click on it and have it mount.

Let me know if that doesn't work. Improving the Safe Mount script is on my list of things to do. If you're using a hardware write-blocker, though, there's no reason to keep it enabled.

Kam

--
You received this message because you are subscribed to the Google Groups "BitCurator Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcurator-use...@googlegroups.com.
To post to this group, send email to bitcurat...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcurator-users/314f235b-2a34-4f98-b93d-43028ace7621%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

[Dorothy Waugh]

Thanks so much Kam! I'll try that and let you know if it works.

Many thanks,

Dorothy

[Dorothy Waugh]

Hi Kam,

I tried disabling the software write-blocking, but still no luck. I don't know if you have used the Tableau write-blockers before, but one thing that I've noticed is that BitCurator seems to be preventing any source drive activity. There's a LED on the write-blocker that signifies source drive activity--when I hook the drive and write-blocker up to our Mac, the activity LED lights up and there's no problem, but when I hook the drive and write-blocker to the virtual machine I get no activity light. The devices menu on BitCurator is still seeing the write-blocker, but it's not showing up in the mount list.

Thanks for your help Kam!

Dorothy

On Monday, October 14, 2013 5:28:48 PM UTC-4, kamwoods wrote:

[Kam Woods]

Hi Dorothy,

Sorry for the delay, I was bit tied up today.

In order to diagnose this, I'll need to know a little more about your setup. The model number and firmware revision of the Tableau write-blocker that you're using, the exact set of steps you're following when plugging it in, and the type (model, size) of drive you're attempting to mount. Also, the host operating system (Win 7, Win 8, Mac OS X 10.x, etc).

At the UNC digital forensics lab, we have Tableau T8 USB writeblockers with the June 21, 2011 firmware (latest), and Wiebetech ComboDock V5 writeblockers for IDE/SATA drives. I've tested both with a range of USB sticks, and hard disks, but I've been unable to replicate your issue (so far).

Here's a screenshot of a setup I just tried with the latest (0.4.2) version of BitCurator: http://www.digpres.com/wbsetup.jpg

I started up BitCurator (leaving the SAFE mount in read-only mode), then plugged a Seagate external USB disk into the T8 writeblocker, then plugged the writeblocker into my Mac (via USB), then turned the writeblocker on. The disk appears automatically in the Unity column on the left, and I am able to mount it using the SAFE mount script in both modes.

Give me a few more details about your setup, and I'll try to replicate ASAP.

Kam

On Mon, Oct 21, 2013 at 11:39 AM, Dorothy Waugh <dorry...@gmail.com> wrote:

Hi Kam,

I tried disabling the software write-blocking, but still no luck. I don't know if you have used the Tableau write-blockers before, but one thing that I've noticed is that BitCurator seems to be preventing any source drive activity. There's a LED on the write-blocker that signifies source drive activity--when I hook the drive and write-blocker up to our Mac, the activity LED lights up and there's no problem, but when I hook the drive and write-blocker to the virtual machine I get no activity light. The devices menu on BitCurator is still seeing the write-blocker, but it's not showing up in the mount list.

Thanks for your help Kam!

Dorothy

To view this discussion on the web visit https://groups.google.com/d/msgid/bitcurator-users/8fc83fd5-3cb2-4c3d-b777-6f2b7b572055%40googlegroups.com.

[Dorothy Waugh]

Hi Kam,

Thanks so much for your email! Let's see if I can answer your questions...

In the case where I'm having a problem, I'm using a Tableau eSATA Forensic Bridge T35es. I've tried with a couple of hard drives, including a 320GB Hitachi Deskstar and a 20GB IBM Travelstar, both from Macs. I don't know about the firmware version for the write-blocker--where would I find that information? Sorry! The host OS is OSX 10.8.5. I'm following the exact same set of steps that you outlined in your message, but get no activity whether the safe-mount mode is read-only or writeable.

I did try connecting a external floppy disk drive (Que! SuperDiskFD, model # LKM-FK73-D) via a Tableau Forensic USB Bridge T8-R2. This worked exactly as it should.

Thanks so much for your help with this Kam. Please let me know if you need anymore information!

Dorothy

[Kam Woods]

Hi Dorothy,

We don't have a Tableau T35es here, but I've replicated your setup as closely as I could: a fresh BitCurator VM, an old eSATA disk pulled from a Mac Pro tower (250GB HFS+ formatted), connected to my MacBook running Mac OS 10.9 via a WiebeTech Combdock V5 in writeblock mode.

It takes a few minutes (2-3), but as seen in the image I attached here, the drive appears and is recognized as containing an HFS+ volume by SAFE mount. So...I'm not sure. There are a couple of possibilities:

(1) You *might* not be waiting long enough for the drive to be recognized. You could try plugging the drive in, leaving it alone for 5-10 minutes and then checking back (it shouldn't take this long, but just to be absolutely sure).

(2) Your Tableau firmware might be out of date, and *might* be causing an issue. The T35es is an older device (released in 2008, and replaced a couple of years ago by the T35es-R2) so if you've never updated the firmware (the last one was released in Jan 2013), you can download the firmware update utility (free!) from Tableau:

http://www.tableau.com/index.php?pageid=products&model=TSW-TFU

You'll need to connect the device to a Windows computer with a FireWire 400 port using the supplied FireWire cable that came with it, and the software will do the rest (you just need to connect and turn on the device).

Kam

To view this discussion on the web visit https://groups.google.com/d/msgid/bitcurator-users/f8f10ade-bc79-4e23-8bed-9e6de8294409%40googlegroups.com.

[Dorothy Waugh]

Hi Kam,

Thanks for your message. We are having some trouble finding a PC (or Mac) with a FireWire 400 port. Is there a reason it has to be FireWire 400? The WriteBlocker also has a FireWire 800 port--can we use that?

Thanks Kam!

Dorothy

[Kam Woods]

Hi Dorothy,

We purchased a T35es-R2, and I've had similar problems testing inside of VirtualBox here. I'll keep you updated as I track down what might be going on...

Kam

To view this discussion on the web visit https://groups.google.com/d/msgid/bitcurator-users/1c5f3974-a27b-48f0-8752-7a133d743a5f%40googlegroups.com.

[Dorothy Waugh]

Thanks Kam! I'll be interested in any updates... We did actually purchase the Wiebe Tech write blocker that you and Porter had suggested earlier and that's been working without a hitch, so thanks for the tip!

[Wendy Hagenmaier]

Hi Kam and Porter,

Have there been any updates about the status of using a Tableau T35es with the BitCurator VM? Georgia Tech was planning to buy a Tableau T35es-R2 for use with the VM, but in light of Dorothy's experience and a few other threads on this list, we're wary about proceeding and would love to hear your advice.

Totally separate question: do you have suggestions about possible types and sources of SCSI write-blocking interfaces to be used with the BitCurator VM?

Many thanks!

Wendy

Digital Collections Archivist
Georgia Tech Archives

To view this discussion on the web visit https://groups.google.com/d/msgid/bitcurator-users/f61451ce-64b9-4324-9f4d-4f23d8265414%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Kam Woods]

Hi Wendy,

Unfortunately, I've had no further success with the T35es-R2 in non-Windows environments.

On the plus side, the WiebeTech UltraDock V5 (read-only) and ComboDock V5 (read/write switchable) are equivalent, connection-wise (SATA and IDE on the drive side, USB 2.0/3.0/FireWire400/800/eSATA on the host side, and have exhibited no such issues. We have several ComboDock units here in our lab - they are better built than the Tableau units, slightly cheaper if you shop around, and have similar throughput speed. http://www.cru-inc.com/products/wiebetech/wiebetech_forensic_ultradock_v5/ **

I don't have a one-shot answer regarding SCSI. At this point, the (new) forensic bridges from the most common US manufacturers focus on serial attached SCSI (SAS). Tableau and WiebeTech, for example, have discontinued products with legacy SCSI connectors on them (take a look at their product page - no more SCSI connectors https://www.guidancesoftware.com/products/Pages/tableau/products/forensic-bridges.aspx)

The device(s) required will depend partly on the materials you wish to image. To start with, there are many types of SCSI connectors in both regular- and micro-packaged physical formats (and various pinouts - 68, 60, 50, etc). See the overview here: http://www.cablestogo.com/learning/connector-guides/scsi

You can purchase "forensics specific" adapters from companies such as ICS and Digital Intelligence (see here, for example http://www.ics-iq.com/category-s/51.htm) but you can also purchase the same adapters much more cheaply on Monoprice, so you might want to shop around before committing.

Once you know what kinds of materials you have to image and what adapters you need, there are still external SCSI write-blockers available from other manufacturers, of course. See here http://www.dataforensicsengineering.com/Write%20Block.htm for example. ICS also sells a kit called the "Super Drive Lock", which comes with multiple SCSI adapters (I couldn't find a dedicated US distributor in a quick search, but here's an example: http://www.alibaba.com/product-detail/Super-Drive-Lock-Hard-Drive-Write_116399056.html) ***

Kam

** This is not an an official endorsement of WiebeTech devices on the part of the BitCurator team or UNC SILS. I'm just passing on our experience.

*** This is not a suggestion that you purchase anything from Alibaba

To view this discussion on the web visit https://groups.google.com/d/msgid/bitcurator-users/CALAPrez21%2B_tzWLN7UhxYQUAjnUcuhkgwZmN3HE%3DkUx2eyasDg%40mail.gmail.com.

[Wendy Hagenmaier]

Hi Kam,

This is very helpful. Thanks so much for these details!

Wendy

To view this discussion on the web visit https://groups.google.com/d/msgid/bitcurator-users/CAAOjFxBR4byf4EER9jJQ9r_cy9cMtnaGLzKcyQi19y%2BKh-eVLA%40mail.gmail.com.

[Walker Sampson]

Hi all,

 

Rather late to this discussion, but I just wanted to add that I received a handful of SCSI drives in 68 pinouts and SCA, and have had some success with Tableau’s UltraBay II (T34589is), which I was able to purchase from a Digital Intelligence warehouse where it was in surplus. I also needed to purchase a FireWire 800 card for my host system, as the internal SATA data connection was not working – the host system was not recognizing the UltraBay II through this connection.

 

Guidance Software has provided email support for me which was a nice bonus, and the Tableau firmware updater still supports this device, although I wouldn’t expect any more updates since it’s no longer produced by Tableau.

 

Best,

Walker Sampson

--

Digital Archivist

Archives and Special Collections

University of Colorado Boulder

(303) 492-9161

To view this discussion on the web visit https://groups.google.com/d/msgid/bitcurator-users/CALAPrezqe5XxFjvPQ5_UynH1OyZpx7tVy39NWi_qOyJ%3DUqJvPA%40mail.gmail.com.