Wiebetech Forensic LabDock
Contents
1. This device complies with Part 15 of the FCC rules Operation is subject to the following two conditions 1 This device may not cause harmful interference and 2 this device must accept any interference received including interference that may cause undesired operation This equipment has been tested and found to comply with the limits for a Class A digital device pursuant to Part 15 of the FCC Rules These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment This equipment generates uses and can radiate radio frequency energy and if not installed and used in accordance with the instruction manual may cause harmful interference to radio communications Operation of this equipment in a residential area is likely to cause harmful interference in which case the user will be required to correct the interference at this own expense In the event that you experience Radio Frequency Interference you should take the following steps to resolve the problem 1 Ensure that the case of your attached drive is grounded 2 Use a data cable with RFI reducing ferrites on each end 3 Use a power supply with an RFI reducing ferrite approximately 5 inches from the DC plug Tested to comply 4 Reorient or relocate the receiving antenna C with FCC standards OR OFFICE OR COMMERCIAL USE2. FORENSIC LABDOCK USER MANUAL Revised July 28 2010 Thank you for purchasing WiebeTech s Forensic LabDock LabDock can be installed into a standard 5 25 bay in any computer to turn it into a digital forensic workstation LabDock allows write blocked access to many kinds of hard drives and other data storage devices Wie 0 Chines FORENSIC LABDOCK Features e Easy attachment and write blocked access to 2 5 and 3 5 IDE PATA and SATA hard drives e Write blocked access to USB flash drives FLDu model only e Convenient storage cubby keeps your drives out of the way during imaging No need to cable down to your table top A quiet fan keeps the cubby cool e Recognizes and reports the presence of a hidden area HPA or DCO on a hard drive Included software utility can be used to configure LabDock to handle such hidden areas the way you prefer e Eight labeled LED indicators report real time operational status WiebeTech Table of Contents 1 Pre Installation Steps 1 1 Forensic LabDock Accessories 3 2 IDE PATA hard drives Forensic Device User Advisory We recommend that you perform a final check on this product Prior to first use please verify that the write blocking function of this product is working properly This is easily done attach a known good formatted drive and verify that the drive mounts properly on your computer Use a drive that has data on it that you are willing to overwrite
3. EE LEA A A gt PLT S ta ue e it _j WIEEEEEREEE F 3 2 2 Attach the IDE and 4 pin power cable connections to the front of the LabDock The IDE interface uses a SafeEject IDE connector to reduce wear and tear Make sure the levers are in the outward position before plugging in the IDE cable WiebeTech 3 2 3 Connect the IDE and power cables to your hard drive Attach the free end of the IDE ribbon cable to the back of the hard drive The connector is keyed to insert only one way WE Next attach the 4 pin power connector from the dock into the back of the hard drive As with the IDE cable the power connector will only fit one way 3 3 USB Drives FLDu model only Forensic LabDock model FLDu is equipped with a write blocked USB connection for attaching a USB thumb drive flash media or drive enclosure 3 3 1 3 3 2 USB Thumb Drives Plug the device into the USB port If the device has an on off switch turn it on There is a Remount button for a few instances where USB WriteBlocker might not be recognized by the computer If that is ever the case cycle the device s power then press the Remount button USB Drive Enclosures The write blocked USB port on Forensic LabDock is designed primarily to work with USB thumb drives However it will also work with many hard drive enclosures that have USB connections Such products must be seen by the computer s OS as a USB Mass Storage D
4. Transfer files to the drive The files will appear to transfer to the drive Thereafter unmount the drive and remount the drive The files that you wrote to the drive should not appear after the drive is remounted If they do appear there is a problem with your forensic device and you should contact our support department for further instructions CRU WiebeTech support may be reached at 866 744 8722 toll free 316 744 8722 international 316 744 1398 fax support wiebetech com email WiebeTech 1 Pre Installation Steps 1 1 Forensic LabDock Accessories Check the accessories with your Forensic LabDock Please contact WiebeTech if any parts are missing or damaged The box should contain the following items Accessories FLDu FLDs Forensic LabDock unit La 4 pin legacy Molex power cable at IDE cable for 3 5 drives 40 pin to 40 pin IDE cable for 2 5 drives 40 pin to 44 pin a a a a o EE ai CD containing manual and warranty info 1 2 Identifying Parts Take a moment to familiarize yourself with the parts of the Forensic LabDock This will help you to better understand the remaining instructions FRONES FORENSIC LABDOCK 1 2 3 4 5 6 7 8 Write block LED Drive Access LED Power LED HPA DCO Indication LED Fan Fail Status LED 12V Drive Power LED 5V Drive Power LED USB Write Block LED A Write blocked USB Port B Reset Button C IDE Connector D SATA data Connect
5. data hidden behind them you may use the Remove HPA tencoredy but ignore DCO Forensic Software Utility select your preferred mode of F Remove HPA permanently but ignore DCO operation There are four modes from which to choose gt Permanently remove them both 4 1 1 MODE 1 Leave them in place This is LabDock s default setting The HPA and DCO areas will be left as is on the hard drive This is an indication only mode LabDock s LED indicator will blink to indicate the presence of hidden areas but no other action is taken WiebeTech 4 1 2 MODE 2 Remove HPA temporarily but ignore DCO This mode temporarily allows you to view information hidden by an HPA to see behind the curtain without removing it No permanent changes are made to the hard drive When the hard drive is disconnected from the write blocker the HPA remains in place Any DCO is left untouched 4 1 3 MODE 3 Remove HPA permanently but ignore DCO This mode permanently removes any HPA making the data behind it visible When the hard drive is disconnected from the write blocker the HPA is not reinstated Any DCO is left untouched 4 1 4 MODE 4 Permanently remove them both Any HPA and or DCO are permanently removed making all of the data behind them visible When the drive is disconnected from the write blocker the HPA and DCO are not reinstated 4 2 Firmware Updates Requires FireWire connection A firmware update may b
6. to 9MB s Speeds vary depending on the drive model type and operating system 2 5 3 5 IDE PATA drives 2 5 3 5 SATA drives USB 1 1 2 0 devices that are recognized as USB Mass Storage devices Works with v4 Combo Adapters to access many more drive types Four modes of operation selectable using software utility 1 Leave HPA and DCO in place HPA DCO Handling 2 Remove HPA temporarily but ignore DCO 3 Remove HPA permanently but ignore DCO 4 Permanently remove HPA and DCO power on off USB write blocking active SATA PATA IDE write blocking active SATA PATA IDE drive activity HPA DCO detected Fan Fail Status 5V drive power operational 12V drive power operational Remount Button Allows changing resetting attached USB device FLDu model only An available USB WriteBlocker API allows software programmers to query built in USB SDK API WriteBlocker to retrieve information from attached devices Works with Windows XP 32 bit version or Windows Vista 32 bit or 64 bit OS Compatibility Windows 7 Vista XP Product Weight 1 55 pounds excluding accessories Dimensions 193 mm x 147 mm x 42 mm We don t want anything to go wrong with your product But if it does Tech Support is standing by and ready to help Contact us through wiebetech com techsupport WiebeTech is a brand of CRU 2011 CRU Acquisitions Group LLC All rights reserved LabDock and TrayFree are trademarks of CRU Acquisitions Group LLC Other marks are the pr
7. IDE PATA drives the type of drive that has a 40 pin data interface Try the MASTER setting first This is the recommended setting for most WiebeTech products Some hard drives have two different MASTER settings one for when there is a SLAVE drive present and one for when there is NO SLAVE drive present Choose the setting for NO SLAVE present There may be some drives that will not work with either of these settings The next choice is CABLE SELECT If this does not work try using NO jumpers This may be the same as MASTER with NO SLAVE present If you re unsure how to change the jumper configuration check the manual that came with your hard drive or the manufacturer s website Some drives also have the information printed on the label For additional FAQs please visit www wiebetech com techsupport WiebeTech 6 Technical Specifications MrT E Forensic LabDock 31320 2209 0000 Internal power connection 12V 5V 4 pin legacy Molex connector or SATA power Power output 12V 5V legacy 4 pin Molex connector Power switch two position sliding switch On Off SATA primary data connection required for IDE or SATA drive access USB required for write blocked USB access FLDu model only FireWire 1394a for firmware updating or HPA DCO mode configuration only SATA As fast as drive can operate typical speeds up to 100MB s Data throughput PATA IDE As fast as drive can operate typical speeds up to 60MB s drive dependant USB up
8. Software Utility The Forensic Software Utility is a free software application designed for optional usage with your Forensic LabDock The Forensic Software Utility allows you to configure the way LabDock handles any hidden areas found on attached drives i e HPA and or DCO update the LabDock s firmware and capture real time info about both the write blocker and the attached drive which can be saved to a log file Forensic Software Utility and its user s manual are available for download from the WiebeTech website http www wiebetech com software Forensic Software Utility ohp or can be found on the CD accompanying LabDock 4 1 HPA DCO Mode Configuration Requires FireWire connection Forensic Software Utility vi 0 0 55 x A Host Protected Area HPA and Device Configuration Call Overlay DCO are reserved areas on a hard drive that FORENSIC SOFTWARE UTILITY een are not accessible by the BIOS or OS Data can be hidden behind an HPA or DCO like a stage hidden behind a curtain Discovery 1 forensic device found Status Write blocking active Devices Forensic Dock Device U58 1394 Tj WriteBlocker Info HPA DCO Behavior Your Forensic LabDock will alert you to the presence of any HPA or DCO by blinking an LED indicator By default LabDock will not remove HPAs or DCOs If you Indicate the presence of any HPA or DCO and then would like LabDock to remove HPAs or DCOs so you Leave them in place can view the
9. Software Utility a free software application designed for usage with Forensic LabDock to select the desired mode of operation See section 3 1 of this manual In default mode Forensic LabDock will only notify you of the presence of these hidden areas by blinking the HPA DCO LED indicator Other modes allow you to view the information in these hidden areas To change modes you must connect Forensic LabDock with a FireWire connection You may find this easiest to do before installing Forensic LabDock inside a computer WiebeTech 1 4 1 Connect a free power cable from your computer s power supply to the rear of LabDock 1 4 2 Attach a FireWire cable to the rear of Forensic LabDock 1 4 3 Connect the free end of the cable to any computer running Forensic Software Utility 1 4 4 Set the HPA DCO behavior using Forensic Software Utility see section 3 1 of this manual 1 4 5 Unplug FireWire and power from the rear of Forensic LabDock NOTE You cannot use FireWire SE SATA connections at the _ same time Please unplug one before attaching the other 2 How to install the LabDock into a computer 2 1 Mount the LabDock into an empty 5 1 2 Bay inside your computer Do not screw it into place until all the cables have been connected 2 2 Connect the USB WriteBlocker using the USB port on the rear of the LabDock There are 3 possible ways to do this If your motherboard has an available 10 pin USB header use the USB
10. e available for your forensic product Forensic Software Utility a free application included on the product CD and on the WiebeTech website can detect this and install updated firmware on your device If your product is running outdated firmware you will see the message below upon launching the Forensic Software Utility application To update the firmware follow these steps He et ede te 1 Click Proceed with Update to begin the evice is running outdated firmware and is in need of an update in order to be be supported by this program update process Please click the Proceed with Update button below 2 You will see a status bar showing the progress to begin the update process of the update Dede Foremic device debated 3 When the update is complete you will see a 09 19 43 May 5 2008 v f 10 0000 message that says Firmware is now up to The device requires updating date Proceed with Update WiebeTech 5 Frequently Asked Questions FAQ Q What are HPA and DCO A A Host Protected Area HPA and Device Configuration Overlay DCO are reserved areas on a hard drive that are not accessible by the BIOS or OS Data can be hidden behind an HPA or DCO WiebeTech forensic devices will alert you if there is an HPA or DCO so that you are aware of it and can take the necessary steps to retrieve the hidden data Q Why does my eSATA device appear as a Parallel SCSI device in System Profiler A The Serial ATA tab
11. evice and cannot be compound USB devices i e products seen by the OS as more than one physical device You may find this feature useful for viewing the contents of a drive enclosure to determine whether it contains digital evidence you need to acquire If it does you can then decide whether to acquire the evidence through the USB connection or open the drive enclosure and access the bare hard drive using the IDE or SATA write blocked connections since those connections will allow faster imaging Note for smaller drive enclosures that operate using bus power Forensic LabDock s write blocked USB port may not provide enough bus power to operate the product Either power the enclosure from an external power source e g AC adapter or use the optional USB bus power cable sold separately WiebeTech 3 4 Other Types of Drives Combo Adapters are available from WiebeTech that can allow your Forensic LabDock to access many other kinds of drives Follow these three simple steps to use a Combo Adapter with your LabDock 3 4 1 Connect the drive to the adapter 3 4 2 Connect LabDock s ribbon cable to the adapter s IDE pins 3 4 3 Attach LabDock s 4 wire power connector to the adapter You are now ready to use your dock to access the drive Combo Adapters are available for SATA drives notebook drives microdrives ZIF drives and more See the WiebeTech website for more details www wiebetech com 4 Using the Forensic
12. in System Profile shows devices attached to the internal SATA bus but not always devices attached to an eSATA host card Sometimes these devices will appear under the heading Parallel SCSI instead This is entirely normal and does not indicate a problem with the device or its drivers Q Why is it necessary to update the firmware of my WiebeTech forensic device A Firmware relates to the programs and data that control electronic products Firmware is enhanced over time usually to add new features or increase compatibility Updating firmware can improve the functionality and dependability of your product If your WiebeTech forensic device is using outdated firmware the WiebeTech Forensic Software Utility can recognize this and implement up to date firmware on your device See section 3 2 of this manual for more info Q My Forensic LabDock works great with SATA drives but am having compatibility issues with IDE PATA drives What should do A First check to make sure the SATA power data cable is unplugged from the SATA output port IDE PATA drives cannot be recognized if a SATA connection is made with the SATA output Next check to make sure the 4 pin power cable is plugged into the IDE PATA drive If the power and host connection are securely attached to the UltraDock then the IDE cable may be faulty Contact Technical Support for further instructions Q How should set my hard drive jumper settings A Note This is only necessary for
13. operty of their respective owners Internal Host Connections Compatibility LED Indicators Limited Product Warranty CRU DataPort CRU warrants this product to be free of significant defects in material and workmanship for a period of two years from the original date of purchase CRU s warranty is nontransferable and is limited to the original purchaser Limitation of Liability The warranties set forth in this agreement replace all other warranties CRU expressly disclaims all other warranties including but not limited to the implied warranties of mer chantability and fitness for a particular purpose and non infringement of third party rights with respect to the documentation and hardware No CRU dealer agent or employee is authorized to make any modification extension or addition to this warranty In no event will CRU or its suppliers be liable for any costs of procurement of substitute products or services lost profits loss of information or data computer malfunction or any other special indirect consequential or incidental damages arising in any way out of the sale of use of or inability to use any CRU product or service even if CRU has been advised of the possibility of such damages In no case shall CRU s liability exceed the actual money paid for the products at issue CRU reserves the right to make modifications and additions to this product without notice or taking on additional liability FCC Compliance Statement
14. or E On Off Power Switch F 4 pin power connector G Cubby for holding media WiebeTech y BEAR SATA data connection primary data connection SATA power connection power from computer s power supply 4 pin Legacy Molex power connection from computer s power supply FireWire port for firmware updates and HPA DCO mode configuration Drive Cooling Fan USB B port data connection for USB WriteBlocker ol a pD 1 3 Host Bus Adapter Installation OPTIONAL Forensic LabDock requires a SATA data connection inside your computer The gt FLDu model also requires a USB data connection for the write blocked USB port If you already have the necessary connectors in your computer you may skip this step If not you can add the necessary connectors by installing a host bus adapter HBA card into an empty expansion slot inside your computer The following general steps will work for most cards Instructions for individual cards may vary so consult your host card s user manual 1 3 1 Power down the computer system 1 3 2 Insert the card into an available compatible slot 1 3 3 Make sure the card is fully seated in the slot Secure with a screw 1 3 4 Turn the computer back on 1 3 5 Install the appropriate software drivers for the card 1 4 Configure HPA DCO Mode OPTIONAL Forensic LabDock gives you the ability to select the way hidden areas HPA DCO on hard drives are handled Use the Forensic
15. to 10 pin header cable 2 If no header is available use a USB B type to B type cable to connect to a USB host card Or use a USB B type to A type cable and attach the A type end to an available USB port on the computer 2 3 Connect a free power cable from your computer s power supply to the rear side of the LabDock There are two options Use 4 pin legacy Molex power or a SATA power cable Molex power connection SATA power connection WiebeTech 2 4 Attach the SATA data cable NOTE You cannot use FireWire Connect one end to the rear of the sA and SATA connections at the LabDock Connect the other end to either i same time Please unplug one a SATA connector on the computer s motherboard or a SATA host card before attaching the other 2 5 Secure the LabDock into place Use the screws provided 2 6 Close up the computer and turn it on Installation is now complete To use LabDock turn it on via the power switch on the front of the unit 3 Connecting hard drives to Forensic LabDock 3 1 SATA hard drives 3 1 1 Insert the drive into the cubby Face the power and data connection outward 3 1 2 Attach the SATA power and SATA data connections to the back of the hard drive Then connect the 4 pin power and the free end of the SATA data cable to the front of the LabDock 3 2 IDE PATA hard drives 3 2 1 Insert the drive into the cubby Face the power and data connection outward pi CECE
Download Pdf Manuals
Related Search