Review date: May 23^rd 2011

Introduction

One of the bug-bears often heard from computer forensic practitioners (or at least those who hold the purse strings) is the relatively high cost of equipment required to carry out our work. I’m not entirely sure why digital forensic hardware is so costly. Perhaps it’s because the demand is relatively small and that production doesn’t benefit from economies of scale? Maybe. So when a USB write blocker arrives which is markedly cheaper than its competitors two things spring to mind. Is it any good? And where can I get it?

I first became aware of Wiebetech’s USB WriteBlocker in June 2006 and emailed their listed UK distributor at that time, Bartholomew Morgan, who didn’t bother to reply. A good start, so I left it at that.  However, last month I became aware that Tap Systems, a decent UK supplier who I’ve dealt with before, were selling these devices, so after a quick exchange of emails with Tap’s Andy Piper, I got hold of one of them to test.

Unboxing and first impressions

First impressions upon unpacking the device were good, since it is so small and lightweight. Having to carry so much hardware equipment when out on imaging jobs means that I’m instinctively drawn to things that won’t contribute to the curvature of my spine and the Wiebetech USB write blocker certainly fits into the you’ll-barely-notice-it category. The box it came in included a 1 metre USB extension cable and a lanyard so that “You can keep USB WriteBlocker handy by wearing it everywhere you go.” Right, because we all want to wear our write blockers everywhere, don’t we? Going out for a meal and during family events, the Wiebetech USB WriteBlocker will be only thing between you and your loved ones.

Figure 1: the Wiebetech USB WriteBlocker with an EnCase HASP dongle for size comparison

It supports USB 1.1/2.0 devices that register with the computer as a “USB Mass Storage Device” which includes USB thumb drives and USB hard drives and could include mobile phones as well as some digital cameras. If the device requires special drivers, it probably can’t see it. Most card readers aren’t registered as ”Mass Storage Devices” but if you do need to image an SD card or memory stick I suggest putting it in its host, be that mobile phone or camera, and then attaching the host to the Wiebetech USB WriteBlocker.

In design, the device is as simple as they come. There’s a USB Type A receptacle at one end where the device you want to examine goes in and a USB Type A plug at the other which you attach to your computer. The direction arrows which indicate the flow of data should help if you were to forget which end the subject drive gets attached to. The LED confirms power to the device and also confirms that the write-blocking ability is active.

And that’s about it. Wiebetech also provides an eight-page PDF manual, a small app “The Forensic Software Utility” which reports attached USB device information and the status of the write blocking device itself. It will also automatically check for firmware updates upon opening, although I’m not sure of this is a good thing since I prefer apps not to attempt internet connections without my explicit approval. I’m sure that a click to ”Check for updates” button would be easy to incorporate.

Figure 2: the Forensic software utility in action. Note the funky serial number.

Using the device

To use the Wiebetech USB WriteBlocker is as simple as you might expect. Simply plug the device into a spare USB port on the machine you are acquiring to (make sure there is a bit of space around the USB port as the device is a little chunky) and then plug the USB device you are acquiring into the Wiebetech’s USB WriteBlocker. That’s it. You’re right blocked and ready to go, and can acquire it in your imaging software of choice, be it FTK Imager, EnCase or X-Ways Forensics.

Testing & Conclusions

I tested three different methods of imaging three different USB devices, two flash drives and a USB hard drive. The flash drives were imaged to a Samsung F3 hard drive connected via eSATA on a Shuttle PC with an Intel Core i7-920 processor and 12GB of DDR3 memory running Windows 7 64-bit. The 160GB USB hard drive was imaged to a SATA connected Samsung F3 hard drive in a HP PC with an Intel E4400 2HGz processor and 4GB of RAM running Windows 7 64-bit. For comparison I imaged all three devices using a hardware imaging device, the Logicube Forensic Dossier, running the latest firmware and software.  The images were made in the E01 format (2047MB chunks) with no compression and no encryption. The results are tabulated below, in hours, minutes and seconds:

Figure 3: comparative times (hh:mm:ss) of imaging USB devices

What struck me initially was that I forgot how long imaging via USB 2 actually takes – a long time indeed. Regardless, the Wiebetech USB WriteBlocker worked perfectly and as expected. The MD5 hashes produced matched those when the same devices were imaged with the Logicube Forensics Dossier.  This is a good point to discuss prices again. The Wiebetech USB WriteBlocker is sold in the UK from Tap Systems for £159.00 plus VAT which includes the USB Power Cable that allows for bus-powered USB drives to be used without an AC adapter. The Logicube Dossier with the USB add-on is approximately £2500.00 plus VAT. Plus the Wiebetech USB WriteBlocker is very light and transportable – it can fit in your pocket. Would I recommend it? I certainly would. Its low price and portability make it an easy decision as a most useful addition to any imaging kit.

The Wiebetech USB WriteBlocker is available in the UK from http://www.tapsystemsuk.com For US and international resellers visit  http://www.wiebetech.com/wheretobuy.php