acarr31 wrote:
...
The next step was identifying if the write blocker was the root cause of the issue. The same scenarios were tested out with an Ultrabay II write blocker (a bit older than the Ultrabay 3d) and the Ultrabay II write blocker did not have an issue seeing the partitions. Also, the Windows 8 GPT OS drive was connected to the Ultrabay 3D with read/write enabled and the Windows 7 system was then able to provide logical access.
The same tests were conducted using an Ultrabay 3d write-blocker connected to a Windows 8 exam system and the error did not occur.
Due to the results of these tests it is the conclusion of the Digital Intelligence tech support staff that the error in access is caused by Windows 7 itself taking issue with the communication of the Ultrabay 3d to Windows 7 that the drive is write-protected.
....
First thing thank you for "finalizing" the thread and reporting in such great the tests performed and the end result.
Allow me however to have a slightly different opinion, ifthere is a culprit it is the actual Ultrabay 3D (or it's firmware).
With all due respect for the good Digital Intelligence guys <img src="images/smiles/icon_smile.gif" alt="Smile" title="Smile" /> , we are talking of Windows 7 (please read as the probably most used OS on forensics machines) and it playing not well with the specific model of write blocker when examining a UEFI/GPT Windows 8 disk (please read as soon to be among the most common piece of evidence that one might need to examine).
I mean, it's not like (say) BeOS is not compatible with the Ultrabay 3d when examining Solaris 9 disks <img src="images/smiles/icon_wink.gif" alt="Wink" title="Wink" /> .
On the other hand *something* has definitely changed between Windows 7 and Windows 8, and I suspect that the behaviour noted/noticed here:
http://reboot.pro/topic/18953-is-winfe-forensically-sound/
about different version of WinFE behaving slightly different when it comes to setting volumes as "read only" is *somehow* connected to the issue you found with the write blocker.
So, putting anyway the blame on the good MS guys is not completely wrong. <img src="images/smiles/icon_eek.gif" alt="Shocked" title="Shocked" />
In any case, the good news are that the older thingy worked fine, so that we can use properly the "legacy" adjective for the Ultrabay II:
http://homepage.ntlworld.com./jonathan.deboynepollard/FGA/legacy-is-not-a-pejorative.html
jaclaz
↧