Tableau External Write Blocker Setup and Forensic Imaging Walkthrough

How to connect and make a forensic image with Tableau external write blockers.
Forensic write blockers prevent the forensic workstation from modifying the source disk. Physical write blockers physically prevent write commands from being sent to the disk, while software write blockers attempt to block writes at the kernel (OS) level. Today we look at three external physical write blockers and how a forensic investigator can use them.
The UltraBlock write blockers were generously loaned by Digital Intelligence, Inc. (bit.ly/DFIRSciDI)
Thank you to our Members and Patrons, but especially to our Investigators, TheRantingGeek, Roman, and Alexis Brignoni! Thank you so much!
00:00 Getting started with external write blockers
00:11 T8u USB Write Blocker
00:36 Connection procedure
00:51 Connection tutorial
01:23 Power on the write blocker
02:24 Forensic Workstation View
03:07 Image target USB device with FTK Imager
04:15 Windows Disk Manager View
05:54 T35u SATA Write Blocker
08:01 Windows Disk Manager View
08:12 Image write-blocked SATA disk with FTK Imager
09:07 Quick disk analysis with FTK Imager
09:39 SATA write block conclusions
10:03 Marker 14
10:06 T6u M.2 Write Blocker
10:43 M.2 to SAS adapter
11:26 T6u Power On
11:39 SATA3 to M.2 Adapter w T35u
12:26 T6u Power On
12:49 M.2 view from the forensic workstation
13:13 Checking read-only partition
13:45 Disk detection with FTK Imager
14:03 External Write Blocker Conclusions
Note that physical and software write blockers can fail. Test your write blocking solutions for regular and odd use cases, and document your results.
🚀 Full Digital Forensic Courses → learn.dfir.science
Links:
Tableau UltraBlock External Write Blocker (bit.ly/DFIRSciUltraBlock)
Digital Intelligence, Inc. (bit.ly/DFIRSciDI)
Related book:
Practical Forensic Imaging (amzn.to/3l2tT2N)
#ultrablock #forensic #imager #tableau
010001000100011001010011011000110110100101100101011011100110001101100101
Get more Digital Forensic Science
👍 Subscribe → bit.ly/2Ij9Ojc
❤️ YT Member → bit.ly/DFIRSciMember
❤️ Patreon → / dfirscience
🕸️ Blog → DFIR.Science
🤖 Code → github.com/DFIRScience
🐦 Follow → / dfirscience
📰 DFIR Newsletter → bit.ly/DFIRNews
010100110111010101100010011100110110001101110010011010010110001001100101
Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License. Please link back to the original video. If you want to use this video for commercial purposes, please contact us first. We would love to see what you are doing.

[@TheMeltzz]

honestly your tutorial teach better and clearer than my uni and on the job training, really appreciate your UA-cam channel.

[@mayavik1034]

Wow man, when I was learning Forensics I wished someone did what you are doing now. Anyway, nice video .

[@ML-lg5zw]

Great info, inherited some Tableau write blockers, about 6 years old

[@Lexzee_Lee]

Thank you for the walkthrough.

[@DFIRScience]

Glad it was helpful!

[@Rareanimal]

Thankyou again

[@DFIRScience]

Hope it was helpful!

[@saeedabedi9015]

Danke

[@CyberForensics_Chic]

I wonder why I can't save this video so I can come back to it later

[@StarBuccaneers168]

Can you use a HDD docking station with the Write blocker bridge?

[@dubled2765]

I can't find Tableau Forensic SATA/IDE Bridge model T35u update - some of the sites require many purchases to start and account or lead admin to start one - anyone know where I can get this update?

[@user-ng7cd3gl7k]

On peu Récupérer les données a l'intérieur du Disque tel quel Avec cette appareil ?!