There is no known reason, to the best of my knowledge (and of course given the data in your post) why this should happen.
You don't mention make/model (and size) of hard disk.
At first sight, I find more probable some kind of incompatibility of *some* kind between the specific write blocker and the specific disk, and/or *some* other more wide incompatibility (write blocker with GPT disks or with GPT disks of a given size or GPT disks of a given sector size, for example).
If I were you I would try contacting Tableau to understand if they are aware of something similar and/or try with the same setup with another write blocker.
If you have the possibility to make a "clone" of the disk, it would be IMHO interesting to see the behaviour of a WinFE build on the clone (with and without the WinFE Read Only Registry settings and with and wiithout the write blocker):
http://winfe.wordpress.com/
as this is something that - unlike the behaviour with "plain" MBR disks:
http://reboot.pro/topic/18953-is-winfe-forensically-sound/
http://mistype.reboot.pro/documents/WinFE/winfe.htm
has not AFAIK been analyzed in detail (at least publicly).
And/or setting the USB device as Read Only (software write blocking).
jaclaz
↧