Idiot Guide No 2:

born-digital archives Tableau Write Blockers

Introduction
Write-blockers enable us to explore and create disk images of hard drives and USB devices without
any risk of accidentally writing to the disk or altering the contents. We have two write blockers, one
for USB devices and one for internal hard drives, of which there are two main types:

IDE drives (also known as Parallel ATA drives) were adopted as a standard in 1990 but are less
common in more modern computers
SATA drives (Serial ATA) were launched c.2003 and are now the most common hard drive
used in desktop and laptop computers

Which Write Blocker to Use

Type of Device Which Write Blocker

USB devices (external Use Write Blocker 1
hard drives and pen (T8-R2)
drives)

Media cards (use USB

card reader)

Hard drives from Use Write Blocker 2

desktop and laptop (T35es)
computers
Use the adapter kit
with smaller laptop
hard drives

It is imperative that the device is connected to the write blocker and the write blocker connected to
the Host Computer (forensic workstation) before the write blocker is switched on.

Write-Blocker 1 Instructions
1. Connect Write-Blocker 1 to Forensic Workstation using USB cable, ensuring that you use the Host
port on the Write-Blocker
2. Connect USB device to Write-Blocker (direct connection for pen drives; use a USB cable for
external hard disks; use an appropriate USB card reader for media cards)
3. Plug in Write-Blocker, ensure ‘DC in’ light is lit. Turn the Power on.
4. The workstation will recognise the USB device and the display of the Write-Blocker should read
‘USB Device Recognised...OK’
 Then proceed to explore the drive or create a Disk Image using FTK Imager (See Idiot’s Guide No 3)

Ensure that you safely eject the Tableau device by using the "Safely Remove Hardware" utility
before switching the write-blocker off or removing the device.

Last updated 6th September 2011 page 1 of 3

 Idiot Guide No 2:
born-digital archives Tableau Write Blockers
Write-Blocker 2 Set-up
When using Write Blocker 2 you will need two cables; one to connect the hard drive to the Forensic
Workstation and another to supply power to the hard drive (via the write-blocker). You will need to
use different cables depending on whether you have an IDE or a SATA hard drive, as explained below.

The drive may not be labelled as SATA or IDE, so check the connections in order to identify it.

To connect the hard drive to the Write Blocker:

Type of drive Signal cable
IDE hard drive from PC TC6-8

IDE hard drive from laptop (see T6-2

below)

Black end into the Tableau adapter

Blue end into Write-Blocker 2

SATA drive TC3-8

Information for laptop hard drives:

Laptop hard drives are usually referred to as being either 1.8” or 2.5”– this refers to the diameter of
the internal platter on which data is stored rather than the dimensions of the unit itself. The 1.8”
drives being used in slimline ultra-portable laptops and 2.5” the normal size used in laptops.

To power the hard drive:

Type Connector Power Cable
IDE Drive 4-pin Molex TC2-8
Some SATA
drives

Some SATA 15-pin SATA TC5-8

drives

SATA drives will have either a Molex or 15-pin connection, or may have both types; in which case use
either power cable but never both simultaneously.

Last updated 6th September 2011 page 2 of 3

 Idiot Guide No 2:
born-digital archives Tableau Write Blockers
Write-Blocker 2 Instructions:
Once you have identified the correct cables:
1. Connect hard drive to Write Blocker 2’s SATA or IDE port using correct signal cable
2. Connect hard drive to Write-Blocker 2’s DC Out using correct power cable.
3. Connect Write-Blocker 2 to Forensic Workstation using USB cable
4. Ensure that all that connections are correctly made
5. Plug in Write-Blocker, ensure ‘DC in’ light is lit. Turn the Power on.
6. The workstation will recognise the hard drive and the Host Detect LED on the write-blocker should
light up (steady illumination). You may need to allow more time for larger drives to mount before
clicking “Next”.
 Then proceed to explore the drive or create a Disk Image (See Idiot’s Guide No. 3)

Ensure that you safely eject the Tableau device by using the "Safely Remove Hardware" utility
before switching the write-blocker off or removing the device.

End of Process
Remember to safely eject the Tableau device by using the "Safely Remove Hardware" utility located in
your Windows system tray before powering down between tests. If the Tableau device is not ejected
properly before powering it down, communication between the device and the host may fail to
function properly until you restart the computer.

Be aware of the risk of the hard drive overheating if it is left on for hours. Using hard drives outside of
their normal environment means there is no fan or other cooling mechanism to prevent it from over-
heating.

Tableau Test Utility

Tableau developed the Tableau Test Utility (TabTest) in direct response to requests for a mechanism
to test and validate Tableau products. TabTest visually guiding the user step-by-step through scripted
tests to validate the functionality of Tableau forensic bridges (a.k.a. write blockers).

This feature only works with a FireWire connection to the Host PC; when HUA receives its second
Forensic Workstation we will be able to make use of it.

Tips
Only connect the Tableau device to the host with one cable at a time. Using more than one cable at a
time may cause a test to fail.

We have an account with Tableau – you can login via the homepage http://www.tableau.com for
latest software and hardware updates.

Last updated 6th September 2011 page 3 of 3