Tableau External Write Blocker Setup and Forensic Imaging Walkthrough
Channel: DFIRScience
Date: 2022-05-17

How to connect and make a forensic image with Tableau external write blockers.

Forensic write blockers prevent the forensic workstation from modifying the source disk. Physical write blockers physically prevent write commands from being sent to the disk, while software write blockers attempt to block writes at the kernel (OS) level. Today we look at three external physical write blockers and how a forensic investigator can use them.

The UltraBlock write blockers were generously loaned by Digital Intelligence, Inc. (https://bit.ly/DFIRSciDI)

Thank you to our Members and Patrons, but especially to our Investigators, TheRantingGeek, Roman, and Alexis Brignoni! Thank you so much!

00:00 Getting started with external write blockers
00:11 T8u USB Write Blocker
00:36 Connection procedure
00:51 Connection tutorial
01:23 Power on the write blocker
02:24 Forensic Workstation View
03:07 Image target USB device with FTK Imager
04:15 Windows Disk Manager View
05:54 T35u SATA Write Blocker
08:01 Windows Disk Manager View
08:12 Image write-blocked SATA disk with FTK Imager
09:07 Quick disk analysis with FTK Imager
09:39 SATA write block conclusions
10:03 Marker 14
10:06 T6u M.2 Write Blocker
10:43 M.2 to SAS adapter
11:26 T6u Power On
11:39 SATA3 to M.2 Adapter w T35u
12:26 T6u Power On
12:49 M.2 view from the forensic workstation
13:13 Checking read-only partition
13:45 Disk detection with FTK Imager
14:03 External Write Blocker Conclusions

Note that physical and software write blockers can fail. Test your write blocking solutions for regular and odd use cases, and document your results.

🚀 Full Digital Forensic Courses → https://learn.dfir.science

Links:
Tableau UltraBlock External Write Blocker (https://bit.ly/DFIRSciUltraBlock)
Digital Intelligence, Inc. (https://bit.ly/DFIRSciDI)

Related book:
Practical Forensic Imaging (https://amzn.to/3l2tT2N)

#ultrablock #forensic #imager #tableau
010001000100011001010011011000110110100101100101011011100110001101100101 
Get more Digital Forensic Science
  👍 Subscribe → https://bit.ly/2Ij9Ojc
  ❤️ YT Member → https://bit.ly/DFIRSciMember
  ❤️ Patreon → https://www.patreon.com/dfirscience

🕸️ Blog → https://DFIR.Science
🤖 Code  → https://github.com/DFIRScience
🐦 Follow → https://www.twitter.com/DFIRScience
📰 DFIR Newsletter → https://bit.ly/DFIRNews
010100110111010101100010011100110110001101110010011010010110001001100101

Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License. Please link back to the original video. If you want to use this video for commercial purposes, please contact us first. We would love to see what you are doing.