Photo courtesy Wiebetech
FEATURED IN TECHNOLOGY AND COMMUNICATIONS
As criminals become more computer savvy, there’s a need for police to secure and investigate data from suspect computers by making quick copies of evidence gathered in an investigation.
“Imaging a hard drive” is a phrase that’s commonly used for preserving the contents of a custodian hard drive or server. An investigator will connect the drive to a write blocker and use software to create a forensic image or evidence file container of the entire contents of the suspect computer on a separate hard drive.
To help accomplish this task of imaging a computer, investigators should check out WiebeTech’s forensic docking device, the UltraDock v5. With five ports on the host side, native PATA and SATA drive connections, two power options and a strong and rugged aluminum enclosure, it truly can be considered the leading forensic imager.
How It Works
The UltraDock v5 device is easy to use: simply snap the suspect drive onto the dock, plug in the power cord and attach a cable to a host computer. Then download and image the entire contents to your computer. The device provides information about the drive you’re investigating, such as model, serial number and S.M.A.R.T data (hours used, power cycles and disk health). Additionally, it can detect, remove, create or modify HPA (Host Protected Areas) created by your suspect, as well as DCO (Device Configuration Overlays), which are hidden from operating systems.
The native SATA and IDE/PATA connections for your hard drives make the UltraDock v5 compatible with most drives on the market. The drive connectors allow for automatic alignment and easy insertion. Although you can attach 2.5-inch SATA drives and 3.5-inch IDE and SATA drives to the UltraDock v5 as shipped, WiebeTech sells a number of combination adapters that allow you to connect 2.5-inch IDE drives, 1.8-inch Toshiba drives and much more.
WiebeTech’s proprietary write-blocked technology ensures that an image hasn’t been tampered with or altered after the fact. With this technology, the UltraDock v5 gives investigators read-only access to suspect hard drives through all ports (eSATA, FireWire and USB) for maximum versatility. This means you can download and image contents of a suspect computer drive without the risk of data being written back to the drive. The product also has status LED lights so you know with a quick look that there’s no chance of writing anything to the drive.
The UltraDock v5 uses a different chipset than its predecessor, the UltraDock v4, which, according to the company, provides faster transfer rates. It also includes a new two-line LCD screen and menu system that conveniently allows you to view drive information and error/warning messages, and navigate through disk configuration with ease. At 4.30-x-2.95-x-0.87 inches (pocket size) and encased in a durable aluminum body, you can take this adapter anywhere you need to go—or anywhere you might need access to a bare drive.
Note: Forensic images are designed to be accessed by computer forensic software (such as Encase, FTK, Winhex and ProDiscover). If you need to access the original custodian information in a forensic image without using computer forensic software, then you’ll need to have it restored to a hard drive in the original native format. Keep in mind, however, that if you rely on a single forensic image and find out later that there was a problem, you may not have a second chance to preserve and collect the information after the suspect retained the computer. It’s well worth the additional cost to create a second backup of the source hard drive if you can.
Conclusion
Many times when investigators execute search warrants, they may not want to take the suspect computer(s). When conducting a fraud investigation at a business, for example, it may not be practical and overly disruptive to the business to take all the computers and hold them for months, especially when they may not have any useful evidence on them. The forensic UltraDock v5 is a beneficial piece of hardware for $249. Police officers will get a compact solution to accessing virtually any drive, and the capability to connect to a Windows-based or Apple computer via multiple interfaces make it a great tool for forensic investigators who need to examine a suspect computer.
Pros
• Easy to use
• Write-block technology
• Compatible with most drives
Cons
• None
Approximate Street Price: $249
WiebeTech
866/744-8722
www.wiebetech.com
