Top Level Category
Table of Contents
Top Level Category
General
Windows XP Administrator Password
Why doesn't my administrator password work?
The first time the system is started, you will be asked to specify a password for the Administrator account. Due to inconsistencies beyond our control, this password may not be properly implemented. If you are unable to log in to the Administrator account using the password you specified, the password “secret” should be effective. After logging in to Windows, the Administrator password may be changed to a password of your choice.
Dynamic Disks
When you move a dynamic disk from one computer to another this dynamic disk is flagged in Disk Manager as a foreign disk. In order to access this foreign disk you must import it first.
To Import the Foreign Disk on Windows XP
1. Click Start
2. Control Panel
3. Administrative Tools
4. Computer Management
5. Disk Management
6. Right click on the Foreign Disk
7. Select "Import Foreign Disk"
What if the "Import Foreign Disk" option is not present.
If you right click on the foreign disk and the "Import Foreign Disk" is not present, this can happen because the dynamic disk was from a Windows XP Pro machine and the new machine has Windows XP Home installed. Windows XP Home cannot read dynamic disks as they do not have a normal partition table.
Convert to Basic Disk
To make the disk accessible to the new machine you will need to convert it to a basic disk. However this process will destroy the data on the disk.
What to do
If this is the case, you will need to put the disk back into the original machine and then remove all the data or the most valuable data to another location such as a writable DVD, another hard disk drive present on the old machine, USB thumb drive / memory disk, tape back or another machine on your network (if you have one) then you can convert it to a basic disk in the new machine and put the data back on it.
How to Configure an IDE Hard Drive
An IDE hard drive needs to be configured as Master or Single (depending on the drive manufacturer) to work properly with the our write block devices. Refer to the label on the drive or the drive manufacturer's website for specific jumper instructions.eSATA
What is eSATA and how is it different that SATA?
eSATA (external Serial ATA) is an extension to the SATA (Serial ATA) standard, which enables SATA drives to be attached to a host computer externally. Although eSATA uses identical protocol signaling as SATA, the physical connector is different. The most obvious difference is that the eSATA connector is straight instead of the "L" shaped SATA connector. eSATA cables also contain an extra layer of shielding and the connectors have metal contact points to reduce EMI. The plug is also deeper to help protect against ESD (Electrostatic Discharge).
Is eSATA a hot-pluggable connection type?
Although eSATA is designed to be a hot-pluggable connection type, this feature requires proper support at the host, device, and controller level. Unfortunately, not all eSATA controller manufacturers properly support hot-plugging.
It is recommended that before disconnecting an eSATA device from your host, you safely eject the device, just as with unmounting a FireWire or USB device. If the eSATA controller does not offer this capability, it may be necessary to power down your machine before an eSATA device can be safely removed.
As with all forensic tools in your arsenal, please test your equipment before attempting to perform an acquisition of an evidence drive.
Is eSATA faster than FireWire 800?
Yes, eSATA is faster than FireWire 800. The maximum *theoretical* transfer rate of an eSATA 150 connection is 1.5Gb/s (or 150MB/s), and an eSATA 300 connection is 3.0Gb/s (or 300MB/s). Whereas FireWire 800 has a maximum *theoretical* transfer rate of 800Mb/s (or 100MB/s).
Keep in mind that these transfer rates are *theoretical*. Actual transfer rates are dependant on many factors.
Unable to see UltraBay II with Tableau Firmware Update. ACS-6xxx device error.
If you have a newer system with USB3 support and you have performed a Windows 7 update, you may experience an issue where the Tableau Firmware Update does not see the UltraBay II.The Windows update fails to recognize our USB3/Firewire card correctly and it installs an ACS-6xxx driver. This driver will cause the USB3/Firewire card to malfunction and won't allow you to use any USB3 or Firewire800 ports or devices. This issue will be apparent if you see an exclamation and the device listed as "ACS-6xxx" in Device Manager.
To fix this, uninstall the ACS-6xxx device in Device Manager (be sure to tick the "Delete the driver software for this device" box). Then when you "Scan for Hardware Changes" in Device Manager it should install the correct driver.
Note that you DO NOT need to be connected to the Internet to do this.
Hardware
Cooling Requirements for Computer Systems
How to Determine BTU Per Hour
To determine BTUs per hour for air conditioning requirements, multiply the total watts of the power supply by 3.413.
Examples:
A 1100W power supply would generate 3754 BTU/Hour.
FRED-C Data Center utilizes a UPS with a maximum output of 2700W. This results in a maximum heat output of 9215 BTU/Hour
.
Power Requirements for Computer Systems
How to Determine Power Requirements
To determine approximate power consumption requirements (base load) use the formula:
Watts / Volts = Amps
Example: 1100 watts / 120 volts = 9.17 amp
Most UPS manufacturers provide interactive calculators you can use to estimate the volts-amperes and watts required to power your systems. Use these links for more information:
Power and Cooling Requirements for a FREDC
DEDICATED 120V/30 Amp electrical circuit terminated in a NEMA-L5 socket.
Cooling
The 3000 VA UPS has a maximum output of 2700W which results in a maximum heat output of 9215 BTU/Hour.
Power Surge on USB3 Hub Port
If you receive the USB3 error "Power Surge on Hub Port, A USB Device has exceeded the power limit of its hub port, (For assistance in solving problem click this message)" follow the procedure below.2. Apply the USB3 driver upgrade (1-RENESAS-USB3-Host-Driver-v2.0.34.0\setup.exe). Reboot if prompted.
3. Install the Firmware Updater (2-USB3-Hub-FW-Upgrade\Usb3HubFWUpgrade_Setup_V0.35.exe). Reboot if prompted.
4. Delete the C:\Program Files (x86)\USB3 Hub FW Upgrade Tool\Bin\810_0880.bin file that was just installed.
5. Copy the 2-USB3-Hub-FW-Upgrade\810_0880_disable_oc.bin file into the C:\Program Files (x86)\USB3 Hub FW Upgrade Tool\Bin directory.
6. Execute the "USB3 Hub FW Upgrade Tool" which you just installed in step 3. Once the new firmware is installed there will be another USB warning, but this is normal.
7. POWER OFF AND RESTART THE SYSTEM. When you run the FW Upgrade Tool it should now show version V8.80.
Connecting a SATA LIF Hard Drive to our SATA LIF Adapter
This is how our SATA LIF Adapter connects to a SATA LIF hard drive. Connecting the drive to the cable can be difficult due to the design of the drive's interface. Below are connection examples (click to zoom).
This is the correct way to connect the SATA LIF cable to the hard drive. Notice there is no blue showing at the top or bottom of the cable connector.
This connection is incorrect. Notice the blue area of the cable above the connector.
This connection is also incorrect. Notice the blue area of the cable slightly below the connector.
Unknown Devices in Device Manager
If you upgrade your older FRED operating system to a newer OS (such as Windows 7) you may have discovered that there are some Unknown Devices in Device Manager. This is due to the fact that Windows 7 was released after these motherboards were released, and the manufacturer may not have created Windows 7 drivers for the board.To determine which hardware/driver component is causing the conflict, open up Device Manager and double-click on the malfunctioning device. Select the Details tab and then the Hardware Ids from the dropdown options. Note the PCI\VEN_#&DEV_#. Enter this value into your favorite search engine and you should see results that reflect the type of device it's assigned to. ie. PCIVEN_11AB&DEV_6145 is assigned to a Marvell 61xx RAID Controller.
Determine which motherboard you have. If you're in Windows XP you can right-click on My Computer and select Details, or simply open up the side panel on the system and look at the motherboard. Once you've discovered your motherboard model number (and it's an ASUS board) you can find drivers via a search at http://support.asus.com. If your motherboard does not offer Windows 7 drivers, select Vista drivers instead.
Adapters / Accessories
Connecting a 1.8" ZIF Hard Drive to the TABLEAU ZIF to IDE Adapter
ZIF drive cables and connectors are very fragile, so take extra care when working with ZIF components.
Currently there are four known manufacturers of ZIF drives: Toshiba, Hitachi, Samsung and Seagate. Toshiba, Samsung and Seagate share the same cable spec, where Hitachi has it's own. Follow the steps below to determine how to connect your particular ZIF drive.
To image a Toshiba drive, connect the Tableau TC20-3-2 ZIF cable to the adapter label face-up. Then connect the cable to the Toshiba drive, positioning the drive label face-down.
To image a Samsung drive, connect the Tableau TC20-3-2 ZIF cable to the adapter label face-up. Then connect the cable to the Samsung drive, positioning the drive label face-up.
To image a Samsung SSD drive, connect the Tableau TC20-3-2 ZIF cable to the adapter label face-up. Then connect the cable to the Samsung SSD drive, positioning the drive label face-down.
To image a Seagate Lyrion drive, connect the Tableau TC20-3-2 ZIF cable to the adapter label face-up. Then connect the cable to the Seagate drive, positioning the drive label face-up.
To image a Hitachi drive, connect the Tableau TC20-3-3 ZIF cable to the adapter label face-up. Then connect the cable to the Hitachi drive, positioning the drive label face-up.
Forensic Card Reader
Read Errors From Card Reader
If you are having read errors while copying data from media inserted into the Forensic Card Reader, make certain that you are not running anti-virus software with real-time protection. If you are running Kaspersky Anti Virus you will need to turn off file protection for removable drives.Forensic Duplicator
How Fast is the Forensic Duplicator?
The Forensic Duplicator's drive operation performance (duplicating, hashing, wiping, etc.) will of course be limited by the slowest drive being used.If you are using fast drives and have high quality cables (such as the cables supplied with the Forensic Duplicator kit) you can achieve rates up to 6GB/min.
Will Duplication Performance Decrease if I Use Hashing on the Fly?
Due to the high-performance architecture of the Forensic Duplicator, on the fly hashing (for both SHA-1 & MD5) is always enabled. The Forensic Duplicator was designed to support simultaneous SHA-1 and MD5 hashing while duplicating drives without compromising drive performance.FREDL
Laptop Case Combination Lock
To Set Combination Lock on Laptop Hard Carrying Case:
1. With the lock open, slide and hold the black release button to the left (towards the numbers).
2. While holding the button to the left set the number wheels to the desired combination.
3. Release the black button. Do not forget the new combination.
Flashing Cursor During Bootup
If your FREDL POSTs but does not boot from the Hard Drive or DVD and displays a blinking white cursor, make certain that there are no USB devices plugged into the laptop. CodeMaster dongles and some HP USB printers have been identified as being devices that the laptop will try to boot from if attached.Hard Drive Enclosures
Installing a Toshiba ZIF Drive Into Our Older Model 1.8" Hard Drive Enclosure
STEP 1: On a new Toshiba drive, the black strip may be in its closed position (laying flat).
STEP 2: If this is the case, carefully pull the black strip back with your fingernail. You may need to use two fingers on each side of the black strip to pull it back evenly. The black strip is standing vertical when open.
STEP 3: Align and place the end of the cable into the hard drive as shown. Push it into the drive's connector until it stops. Do not force the insertion or you may damage the cable/drive.
STEP 4: If you will be mounting the drive into the case permanently, push the black strip forward and flat to tighten the connection. If you are working with the drive temporarily, you do not need to close the connector.
STEP 5: Without creasing it, carefully create an "S" curve in the cable.
STEP 6: This is how the cable and interface board will fit behind the drive when it's inside the enclosure.
STEP 7: When inside the enclosure, notice that the drive is held securely by butting up against the interface board.
STEP 8: Hopefully your drive and interface board fit snug enough to remain in place when you let go of the components. You can try squeezing the ends of the enclosure together to get rid of any gap that may be present.
STEP 9: If you have problems with the components staying in place when you try put the cover on, take a disconnected USB cable and plug the appropriate end into the board to hold it in place while you apply the cover.
STEP 10: If the board slips out of position, you can carefully manipulate the board with the USB connector as you push down on the cover.
Installing a Hitachi ZIF Drive Into Our Older Model 1.8" Hard Drive Enclosure
STEP 1: The Hitachi ZIF drive connector is designed a bit different than Toshiba's. Even though the enclosure was designed for Toshiba drives, the Hitachi can also be installed into our 1.8" ZIF Hard Drive Enclosure. The Hitachi has a white bar on the cable connector that you'll need to fold up.
STEP 2: As with the Toshiba drive above, insert the cable into the connection. Make an "S" curve in the cable.
STEP 3: This is how the cable and interface board will fit behind the drive when it's inside the enclosure.
STEP 4: If necessary use the method in Steps 9 and 10 above to place the cover on the enclosure. Be aware that the Hitachi drives are thinner than the Toshiba's and won't fit as snug.
Setup / Troubleshooting
Testing Memory in Problematic Systems
Systems that reboot sporadically, experience Blue Screens of Death (BSoD) and other strange system behavior can often be attributed to bad memory. Below are some RAM testing recommendations. If either program identifies bad memory, try reseating the RAM as this will often fix problems. If it doesn't alleviate the problem, try to narrow down the bad stick(s) by installing one stick at a time and running the memory test.
If you can boot to Windows
There is a commercial testing application from http//www.passmark.com called BurnIn Test. The trial operates for 30 days and is very good at detecting bad RAM within minutes. We find this program to be more reliable at detecting bad RAM than the method listed below.
If you cannot boot to Windows
There a free RAM tester available at http://www.memtest.org. Download the ISO, burn it to a CD, boot the sytem from the CD. Let the application run for a few hours or overnight.
Beeping or Alarm Sound From the Back of a FRED System
If your system contains a dual or triple redundant power supply, this is a power supply warning. You'll need to make certain that all modules are plugged into a power outlet and that their switches are in the "on" position. Sometimes re-seating the modules will fix the problem.If you've tried the above and are still experiencing the beeping sound, a module may need to be replaced. In this case, you can press the "silence alarm" button on the power supply and contact us to discuss warranty replacement of the problematic module.
You may still operate your FRED system without the bad module while awaiting a replacement.
Windows XP Service Pack 3
If you have updated to WinXP Service Pack 3 and are experiencing problems with your UltraBay, Hotswap drive bays and/or external write blockers connected via Firewire or USB you will need to uninstall SP3. Many people are experiencing problems with Firewire and USB after an SP3 update. This is not limited to our systems, but any system running SP3 utilizing Firewire devices (our UltraBay and Hotswap Drive bays are Firewire-based). Please do not update to SP3 until Microsoft addresses these issues. If you already updated, it is preferable that you go back to a restore point before the update. You can also try the Add/Remove Programs option of your Control Panel to remove the SP3 update.
Windows 7 Firewire Drivers
If you're running Windows 7 and are experiencing host disconnects and/or slow performance with your UltraBay, firewire hotswap bays or other firewire 800 devices check to see that you're running the "Legacy" drivers for your firewire controller.1. In Device Manager, expand the item "IEEE 1394 Bus host controllers".
2. Right-click -> Properties on the first 1394 OHCI Compliant or Texas Instruments Host Controller.
3. In the Driver tab, Click "Update Driver" button.
4. Click on the "Browse my computer for driver software".
5. Click on "Let me pick from a list of device drivers on my computer".
6. Choose the "1394 OHCI Compliant Host Controller (Legacy)" option.
7. Click "Next" and it should install the driver. Do the same for the other controller.
BIOS Settings
UltraBay General Questions
UltraBay 1 Write Protect Switch
When I push the write protect switch on the UltraBay 1, the write protect light does not change.
This is because the UltraBay needs to be power cycled. The correct procedure for toggling the write protect on the UltraBay is as follows:
1. Turn your UltraBay off.
2. Toggle the write protect switch.
3. Turn your UltraBay back on.
This process should change the write protection state.
UltraBay Not Detecting Laptop SATA Drives
The UltraBay does not detect a Laptop SATA drive and the lights keep cycling.
There was a bug in the firmware that affected laptop SATA drives. The latest firmware resolves this issue.
UltraBay II Write Protect Switch
How do I toggle the Write Protect function of the UltraBay II?The UltraBay can be switched into read/write mode for SATA/IDE/SCSI operation (USB and FireWire ports are always write-blocked).
Before switching the UltraBay II on or attaching a drive, press the Menu button until you reach the Switch RO/RW function. Press Enter (and then Enter again) to change the state to read/write.
The write protect will be turned on automatically once you power cycle the UltraBay II. This auto-RO behavior is a safeguard against accidentally leaving the bridge in RW mode.
UltraBlock and FireFly IDE
FireFly IDE vs UltraBlock IDE
How does the FireFly IDE compare to the UltraBlock IDE?
The FireFly IDE bridge is an ultra-compact forensic bridge for use with IDE hard disks. To make the FireFly as small as possible, several features were removed that are found on the UltraBlock IDE. Namely, the FireFly lacks a USB host interface, power switch, dual power supply options, host detect, and drive detect LEDs.
Even though the FireFly has fewer features than the UltraBlock IDE bridge, the FireFly achieves imaging times comparable to the UltraBlock and retains key UltraBlock IDE features such as the write block, activity, and power LEDs and configuration switches. Moreover, the FireFly connects directly to the back of the IDE hard disk, eliminating the need for an IDE signal cable.
Yellow UltraBlock and FireFly
Why is my UltraBlock or or FireFly yellow?
The UltraBlock and FireFly IDE bridges, like all UltraBlock forensic bridges, can be configured for read-only or read-write operation. Some customers require the UltraBlock and FireFly units pre-configured for read-write operation. To make these units stand out, so they aren't accidentally confused with write-blocking UltraBlock forensic bridges, these units are encased in yellow cases instead of the standard black cases.
UltraBlock and FireFly SATA
FireFly Power Consideration
Can I use the "legacy" power connector on a SATA hard disk when using the FireFly?
If the SATA hard disk has both a SATA-style 15-pin power connector and an older 4-pin "Molex-style" legacy power connector, you must not apply power to the 4-pin "Molex-style" power connector when using the FireFly. The FireFly provides power to the hard disk through the SATA-style 15-pin power connector. Applying power to both connectors at the same time may seriously damage the SATA hard disk, the FireFly, or both.
If the SATA hard disk has only the older 4-pin "Molex-style" power connector, then it is not possible for the FireFly to provide power directly to the hard disk and you must power the hard disk through the 4-pin "Molex-style" connector.
FireFly SATA vs UltraBlock SATA
How does the FireFly SATA compare to the UltraBlock SATA?
The FireFly SATA bridge is an ultra-compact forensic bridge for use with SATA hard disks. To make the FireFly as small as possible, there were several features removed that the UltraBlock has. Namely, the FireFly lacks a USB host interface, power switch, dual power supply options, host detect, and drive detect LEDs.
Even though the FireFly has fewer features that the UltraBlock SATA bridge, the FireFly achieves imaging times comparable to the UltraBlock and retains key UltraBlock features such as the write block, activity, and power LEDs and configuration switches. Moreover, the FireFly connects directly to the back of the SATA hard disk, eliminating the need for a SATA signal cable. And, if the SATA hard disk has a SATA-style 15-pin power connector, the FireFly powers the hard disk directly, further eliminating the need for a power jumper cable.
Super Talent 8GB 2.5" SATA Solid State Drive
I'm trying to acquire a Super Talent 8GB SATA flash drive with a Tableau forensic bridge, and I'm getting really slow transfer rates.
The Super Talent 8GB 2.5" SATA Solid State Drive (model #FSD8GC25M) has a low-level communication incompatibility with the SATA chipset used in some older revisions of the UltraBlock bridges. The symptom is extremely slow data transfers. This incompatibility will occur with all versions of the UltraBlock SATA. This will also occur with FireFlies and UltraBays manufactured before July 1, 2006.
The newer UltraBlock IDE/SATA and UltraBlock eSATA IDE/SATA devices should work properly with this drive.
UltraBlock General Questions
Firewire vs USB
Which is faster, FireWire/1394 or USB2.0?
FireWire (IEEE 1394) is generally faster than USB 2.0 when using Tableau forensic bridges. FireWire400 (1394A) can be 30% to 50% faster than USB 2.0 on a given system and FireWire800 (1394B) provides for an additional increase in transfer rates.
Host Protected Areas and Device Configuration Overlay (HPA and DCO)
Do UltraBlocks support HPA/DCO?
Yes, with the latest firmware UltraBlock IDE and SATA bridges can detect and override both HPA (Host Protected Area) and DCO (Device Configuration Overlay) regions on a hard disk.
HPA and DCO refer to specific mechanisms that can be used in IDE and SATA hard disks to "hide" regions at the "end" of a hard disk. Commands related to HPA and DCO are defined in the ATA specifications for hard disks, and these commands are often used by computer manufactures to hide, and thus protect, recovery partitions located at the end (or top) of the hard disk.
In theory, HPA and/or DCO commands could be used in order to hide user data as well.
To upgrade your Tableau IDE or SATA bridges with support for HPA/ DCO, please download the latest UltraBlock Firmware Update.
HPA and DCO Handling
How do UltraBlocks handle HPA and DCO?
If HPA is being used to protect a region at the end of the hard disk, the Tableau bridge will automatically use "volatile" HPA commands to override the HPA setting, automatically making the HPA region visible to the host computer so normal imaging tools can access the data in the HPA region.
If DCO is being used to protect a region at the end of the hard disk, the Tableau bridge will not automatically override DCO. To do so, the Tableau bridge would need to send a permanent (ie., non-volatile) command to the hard disk, and this would permanently alter the hard disk's DCO settings. Instead, Tableau plans to release utilities which can be used in conjunction with Tableau bridges in order to override the DCO settings at the explicit direction of the user.
HPA/DCO Mode
Will the UltraBlock's HPA/DCO support alter the hard disk permanently?
The commands needed to override DCO are permanent, so they will be retained even after the hard disk is power-cycled. For this reason, an UltraBlock will never send DCO commands to a hard disk except under the explicit control of the user.
UltraBlock Configuration Switches
Why are there switches on UltraBlocks?
The switches provide two main functions:
1) Allow UltraBlocks to be field-switched between read-only and read-write operation.
2) Allow end users to set the bridge's configuration for optimal use with their equipment.
Versatile Operation
In Write Protect mode, the UltraBlock will prevent ANY and ALL writes from reaching the attached device. It is compatible with all Windows 98se, Windows ME, Windows 2K/XP, and any O/S that supports IEEE 1394 and has a compliant card and drivers.
In Read/Write mode (non-Write Protected), it can be used to attach a drive to be used for receiving images on your FireWire chain.
The UltraBlock is shipped by default in a Read-Only (write blocking) configuration. However, they can be configured to enable Read-Write operation as well*. To prevent unwanted alteration it necessary for the customer to make a modification to the housing to enable the Read-Write operation.
SWITCH 1
OFF = Read Only (write blocking enabled)
ON = Read/Write
SWITCH 2
OFF = Unit reports errors if writes are attempted
ON = Unit suppresses errors if writes are attempted
SWITCH 3
OFF = Unit reports Write-Protect (WP) status in code page
ON = Unit supresses Write-Protect (WP) status in code page
SWITCH 4
Reserved
* The UltraBlock USB and UltraBlock Firewire cannot be switched to Read/Write mode. They were designed to be permanently Write Blocked.
UltraBlock Switches
Can't you ship forensic bridges that work in all situations without configuration switches?
For example, one of the ways to make older Windows operating systems work "correctly" with forensic read-only bridges is to make the OS "think" that the bridge/hard disk is really read-write. In this mode, the bridge simply "throws away" any writes sent by the computer to the hard disk. But, this can lead to problems, as Windows maintains an in-memory cache of what it "thinks" is on the hard disk. When a bridge throws away write data, but makes the computer think the write succeeded, Windows gets out of sync with what's really on the disk; and this can lead to errors in capturing forensically sound images from a subject drive.
When necessary, i.e., when using an older Windows OS, the UltraBlocks can be configured to trick Windows as just described. But, if you are using a version of Windows like Windows XP - which handles read-only bridges correctly - you are far better off if the bridge tells Windows that it is read-only. In this way, you can guarantee that Windows XP is in sync with the data that is really on the disk, and you can guarantee the forensic validity of images captured from the subject hard disk.
UltraBlock Write Block LED
Why do UltraBlocks have an LED marked "Write Block"?
UltraBlocks can be switched between read-only and read-write operation at the user's discretion. The "Write Block" LED provides the user with a positive indication that the bridge is configured for read-only (write-blocking) operation when the bridge is being used to capture a forensically sound image from a subject hard disk.
IDE Drive Not Detected With the UltraBlock IDE/SATA
The IDE cable provided with the UltraBlock device must be oriented with the BLUE end of the cable plugged into the UltraBlock and the BLACK end plugged into the hard drive.Check the pins on the UltraBlock IDE interface. The 10th pin from the left on the top row should be the only missing pin. We have seen instances where the 11th pin on the bottom has been pushed in due to incorrect cable insertion. If this 11th pin is pushed in, please contact us for assistance.
UltraBlock SCSI
Green and Yellow LEDs
What is the meaning of the two LEDs (one green and one yellow) on the side of the UltraBlock SCSI bridge?
HVD SCSI
Will the UltraBlock SCSI bridge work with HVD SCSI?
No, the UltraBlock SCSI bridge does not directly support the older SCSI HVD (High Voltage Differential) standard. However, some companies manufacture HVD-LVD converters which can be used to convert the HVD interface on an older hard disk to the LVD standard supported by the UltraBlock.
Multiple SCSI Devices
Can I attach more than one SCSI device to the UltraBlock SCSI bridge at the same time?
SCSI Detect Light
What does it mean when the SCSI Detect light on the UltraBlock SCSI bridge is blinking?
SCSI Device Jumpers
Do I need to jumper a SCSI device for a specific SCSI ID when I'm using the UltraBlock SCSI bridge?
SCSI Termination
Does the UltraBlock SCSI bridge terminate the SCSI bus?
Ultra320 SCSI Hard Disks
Will the UltraBlock SCSI bridge work with Ultra320 SCSI hard disks?
Yes, the UltraBlock SCSI bridge should be compatible with hard disks including new Ultra320 hard disks.
The SCSI standard requires devices to be backwards-compatible with slower transfer modes, for example, so that new hard disks can be compatible with slower host adapters and vice-versa. The UltraBlock SCSI bridge supports SCSI transfer modes up to Wide Ultra 2 SCSI - also known as Wide FAST-40 - for a maximum transfer rate of 80MB/sec. The UltraBlock SCSI bridge will "negotiate" with the SCSI hard disk to determine a mutually acceptable SCSI transfer mode.
UltraBlock USB
Mass Storage Devices
Can the UltraBlock USB Bridge work with compound USB devices?
Memory Card Readers
Does the UltraBlock USB work with USB memory card readers?
For example, USB memory card readers often support more than one type of memory card/slot. If the USB memory card reader reveals itself on the USB interface as a single USB device (or "function" in USB parlance), then the UltraBlock USB will generally work well with the USB memory card reader. However, if the USB memory card reader reveals each memory card/slot as a different USB device - that is, the USB memory card reader presents itself as a compound device - then the UltraBlock USB may not work as expected. The UltraBlock USB will "lock onto" the first mass storage device it finds, ignoring the others. If a memory card is inserted into a slot in the reader which isn't the "first" device, then the UltraBlock USB won't find the memory card.
Unfortunately, it is very difficult to know without testing how a given USB memory card reader is implemented. USB memory card readers which have only a single memory card/slot will generally work with the UltraBlock USB.
As an alternative to the UltraBlock USB, if you need to acquire memory cards in a forensically sound environment, Digital Intelligence recommends you consider purchasing our USB forensic memory card reader.
Device Not Detecting Drives
My UltraBay, UltraBlock and/or FireFly is not detecting the attached drive. What can I do?
Check that your drive is truly not being detected by checking in Disk Manager. In some cases, Windows will not assign a logical drive letter to your hard drive. If this is the case you will need to image the drive on a physical level.
IDE
The latest firmware update has IDE detection enhancements.
Make sure your drive is configured as a standalone master device.
SCSI
The latest firmware update has SCSI detection enhancements.
If you're trying to connect without termination, try it with termination or vice versa.
Try and power the drive from an external power source. Some older drives needed substantial power to spin up.
Supported Devices
What kinds of USB devices does the UltraBlock USB support?
The UltraBlock USB is currently designed to work with USB Mass Storage Class devices. This includes most USB "thumb drives", many USB digital cameras, Apple iPods with USB interfaces, hard disks in external USB enclosures, etc.
From a technical standpoint, the UltraBlock USB currently supports USB devices which conform to USB Class 8 (Mass Storage), Subclass 2 (SFF8020I), SubClass 5 (SFF8070I), or Subclass 6 (SCSI). Additionally, the T8 requires that the USB device implement Protocol 50h (Bulk Only).
The T8 originally supported only Subclass 6 (SCSI). Support for Subclasses 2 (SFF8020I) and 5 (SFF8070I) were added as of Tableau Firmware Update v3.30. This firmware update corresponds to T8 firmware date codes of Oct 19 2005 and later.
USB Device Not Detected
The UltraBlock USB is not seeing my USB device.
USB Hard Drive Not Detected
The UltraBlock USB is not seeing my USB hard drive.Some external USB drives draw more power than the UltraBlock can provide. In this case a powered USB
hub would provide adequate power.
Sales
Sales Information
Digital Intelligence offers a secure Online Store. The products listed in our store are available for purchase online. If you require a special order item, quotation or a system with upgrades that are not listed, please contact us at 866-344-4683 or 262-782-3332.
If you would like to send sales electronic correspondence you can submit our Sales Form.
How do I Place an Order With Digital Intelligence?
Orders may be placed using our online store with a credit card.
Orders may be also be placed online using a Purchase Order. Please reference the PO number on your online order and send us a copy of your PO for our records. Purchase Orders may be emailed to sales@digitalintelligence.com or faxed to 1-262-782-3331.
When Will my Order Ship?
Orders placed by noon US Central time Monday - Friday are processed the same day and, if the items you ordered are in stock, usually ship that same day. For rush orders, please contact one of our sales reps by calling 1-262-782-3332.What are Stock Items?
Most of our write blockers and accessories are stock items. Our FRED systems are built to order and usually ship in 5-15 business days. Some software items ship directly from the manufacturer (see note for international customers), some software is downloadable, others require shipping. See the software description for more information, or contact us.Do you Accept Credit Cards?
Digital Intelligence accepts Mastercard, Visa and American Express.How do I use a Purchase Order?
Government or law enforcement organizations do not need prior approval to submit a Purchase Order. We do require a copy of the PO (or some sort of documentation) for our files. Other organizations will be approved on a case-by-case basis and can either contact us prior to submitting a purchase order or provide contact information with the PO.Are Other Payment Options Available?
We offer a wire transfer option for select customers, for orders over $1000 US. For more information, please contact us. If you want to pay by check or money order, we must receive your payment prior to shipment.How Soon Will I Get My Order?
Most products ship from our warehouse in Wisconsin. UPS Ground delivers to most locations in the US within 3-5 business days. Allow additional time for shipments to Hawaii, Alaska, US Territories, APO/FPO addresses and outside the US. Deliveries are generally not made on weekends or holidays, and extra time should be allowed during US holidays.What if One of My Items is Out of Stock?
We will hold the order for all the items unless you tell us to ship a partial order. We will contact you to discuss options for shipment of the out of stock items. If an item is out of stock, it is usually available within a few days.When Will I Get my Software?
Depending in the product, software is delivered by an electronic method (email/download), shipment of physical media (CD/DVD) or a combination of both. See the specific software description page or contact us for more information.Do you Ship Internationally?
Digital Intelligence ships products all over the world. Some products may have shipping restrictions or license requirements for international shipping. If you are outside the US and want to order software products, please contact us for more information. International orders require payment in advance of shipping unless otherwise stated. See our Company page for information about international resellers or distributors. APO/FPO customers need to contact us for a quote.What About Customs Duty or Import Fees?
The recipient is responsible for paying any tax, customs duty or fee imposed as a result of the purchase. Digital Intelligence’s shipping cost is for carriage only.Do you Have Resellers?
We do not have authorized resellers or distributors in the US. Please see our website for information regarding authorized resellers located outside the US.Do you Offer Education Discounts?
There are a few, but generally our products are not eligible for education discounts.What is the Return Policy?
If you change your mind, you can return an item within 30 days for refund of the purchase price. Some conditions apply and some products are subject to a 15% re-stocking fee. There is no refund for the shipping charge. Contact us for an RMA number if you want to make a return. An RMA number is required for any return.What if Something is Wrong With my Order?
Contact us right away, either by calling or sending email to Support. Be sure to request an RMA number if you need to return an item.How do I get Technical Support?
Either call us during our regular business hours or click on our Support page to send email.What if I Don't Know Exactly Which Product is Right for my Needs?
Please contact us directly, either by email or give us a call during our business hours. One of our technical sales representatives will help you determine what products best suit your requirements.Services
How do I get more information on the Services you offer?
We offer Forensic Analysis, Litigation Support and Consulting.
Please visit our Forensic Services area, submit the information request form and we will contact you. You may also call us 262-782-3332.
Software
What type of Software do you offer?
Digital Intelligence offers both software that has been programmed in-house, and proven third party forensic suites and applications. Please visit our Software Area for descriptions and pricing.
Windows XP 64-bit Support
The Window XP 64 bit Operating System is not offered or supported by Digital Intelligence. All systems ship with a 64 bit version of Linux. If you require a 64-bit Windows platform, we recommend Vista 64-bit Ultimate or Windows 7 64-bit Ultimate.MSXML6 Installer Error When Installing FTK 2+
If you receive an error regarding MSXML6 Installer during the Microsoft SQL 2005 installation on Windows XP (during an FTK2+ installation) please see the Microsoft Knowledgebase article 29031 to fix the problem.Encase Shows that an UltraBlock or UltraBay is not Write Protected
Versions of Guidance Software's Encase prior to 6.13 incorrectly reported the write protected state of a drive connected to an UltraBlock or UltraBay. If you are running Encase 6.xx, make sure it is version 6.13 or later.How do I get Greater than 2Gb Partition Support Under Windows Vista 64-bit for my FRED's RAID?
You need to change the RAID controller card's driver from Vista's to the one included on the Adaptec driver CD (Adaptec Installation CD). The driver CD was included in your system's toolbox.1. Find the RAID controller in Device Manager and choose Update Driver Software.
2. Browse My Computer.
3. Choose "Let me pick from a list of device drivers on my computer."
4. Choose "Have Disk / Browse".
5. Point to the "CD:\windows-win2003\driver\amd64\" directory.
6. Once the driver is installed you should see an option for GPT in Disk Management.
FRED Restore Disks
Error 11030 During Restore
If you receive the error Usage Error 11030 - Invalid Destination Drive while trying to restore your system from our Factory Image Restoration DVD, make sure you do not have any USB devices (such as thumbdrives, Multimedia Card Reader or USB KVM switch) connected to the system. The restoration environment recognizes these USB devices as disk drives and tries restoring to them.Z:\ Prompt
You will see the Z: prompt after running the factory restore process from an older Ghost Installation and Maintenance DVD. This indicates that the restore process has finished. You can now remove the restore DVD and reboot the system.Linux
UltraBlock not Working Via USB With Linux Kernel 2.6.10 or Later
Linux distributions based on Kernel 2.6.10 and later may have problems communicating with an UltraBlock SATA, SCSI, IDE, or USB when the bridge is connected to the computer via USB.
To resolve this problem, update the UltraBlock's firmware to the latest version.
UltraBlock not Working Via FireWire 400/1394A With Linux Kernel 2.6.17 or Earlier
If your computer has a 1394B (FireWire 800) host adapter, then older Linux kernel releases will try to communicate at FireWire 800 speed even when 6-pin FireWire 400 cabling is used.
To avoid this problem, either use only 9-pin FireWire 800 cabling or switch to Linux kernel 2.6.18 or newer. These kernel releases are capable of downgrading to FireWire 400 speed when using 6-pin cables.
SUSE 10 Boot Error Following Factory Restore
SUSE 10 uses Disk ID's to reference filesystem mount points. Disk ID's are specific to each disk by serial number so an image created on one system with a specific disk (our reference platform) won't be immediately bootable on another system since the other system has a different disk.The solution: Change the references in the mount file (/etc/fstab) and the boot loader menu file (/boot.grub/menu.lst) to refer to the disk by Device Name instead of Disk ID.
Step 1 - (getting logged in so changes can be made)
- At the Linux Boot Menu simply type "root=/dev/sda2" (no quotes). Do not change the boot menu selection (leave it on the top option), just start typing and the text will start appearing on the boot options line at the bottom of the screen. Then hit enter and the system will boot. The first time a user boots their system after restoring an image, it will take a bit of extra time as the file system needs to be checked (via fsck)
Step 2 - (changing device references to eliminate having to use step 1 to boot the system)
- The following two files will have to be edited and the DiskID references changed to Device Names.
Here are the two files:
/etc/fstab
/boot/grub/menu.lst
- The user can edit these by whatever method they prefer. If they are not familiar with linux, the easiest method is to run the "root's home" icon from the desktop, and hit the up arrow once to move to the top of the file system. (This is just like Windows Explorer). They can then drill down through the filesystem and double click on the above two files to bring each into the editor (gedit) in turn. Once each file is in the editor, its recommended to maximize the gedit window so line wrap is not confusing..
- In /etc/fstab make the following changes:
Where it says: Change it to:
/dev/disk/by-id/scsi-SATA_ST3500641AS_3PG0021B-part1 /dev/sda1
/dev/disk/by-id/scsi-SATA_ST3500641AS_3PG0021B-part2 /dev/sda2
- In /boot/grub/menu.lst make the following changes:
Everywhere it says: Change it to:
root=/dev/disk/by-id/scsi-SATA_ST3500641AS_3PG0021B-part2 root=/dev/sda2
- Depending on the particular drive used to build the image, the Disk ID's might be a different, but the associated disk id that needs to be replaced should be obvious.
SUSE 11 Boot Error Following Factory Restore to FRED With RAID
Step 1 - At the Linux Boot Menu type "root=/dev/sdb". Do not change the boot menu selection (leave it on the top option), just start typing and the text will start appearing on the boot options line at the bottom of the screen. Then hit enter and the system will boot.Step 2 - Edit /boot/grub/menu.lst to replace "/dev/sda" references to "/dev/sdb".
Step 3 - Edit /etc/fstab to replace "/dev/sda" references to "/dev/sdb".
Training
How do I get more information on the Training you offer?
We offer Forensic system and software training. Please visit our Forensic Training area for information and dates of upcoming classes.