WiebeTech 31350-1909-0000 Forensic UltraDock FUDv6 Instruction Manual

WiebeTech 31350-1909-0000 Forensic UltraDock FUDv6

The Forensic UltraDock FUDv6 is a device designed for forensic data investigation and analysis. It allows users to connect various types of drives to a computer, providing write-blocking functionality to ensure data integrity. The device comes with a USB Type-C cable for connecting to a computer and supports nonstandard drives through adapters available at wiebetech.com/products/#SATA_and_PATA_Adapters.

Product Warranty

CDSG warrants this product to be free of significant defects in material and workmanship for a period of two (2) years from the original date of purchase. The warranty is limited to the original purchaser and is nontransferable.

FCC Compliance Statement

This device complies with Part 15 of the FCC rules. It is designed not to cause harmful interference and must accept any interference received, including interference that may cause undesired operation. The equipment has been tested and found to comply with the limits for a Class B digital device, providing reasonable protection against harmful interference in a residential installation. However, improper installation or usage may result in harmful interference to radio communications.

Resolving Radio Frequency Interference

If you experience Radio Frequency Interference, follow these steps to resolve the problem:

1. Ensure that the case of your attached drive is grounded.
2. Use a data cable with RFI reducing ferrites on each end.
3. Use a power supply with an RFI reducing ferrite approximately 5 inches from the DC plug.
4. Reorient or relocate the receiving antenna.

Product Usage Instructions

Introduction

The Forensic UltraDock FUDv6 connects to your computer via a USB Type-C cable. For nonstandard drives, adapters are available for additional flexibility at wiebetech.com/products/#SATA_and_PATA_Adapters.

Safety Information

Before handling this product, please observe the following safety precautions:

1. Do not drop, impact, or pierce the product.
2. The circuit boards within the product are susceptible to static electricity. Proper grounding is strongly recommended.

How Write-Blocking Works

Write-blocking works through a process known as spoof writing. When copying files to a write-blocked drive, the operating system appears to successfully write the files, but they are not actually written to the drive. When disconnecting and reconnecting the drive, the copied files will no longer be present. This is because the Forensic UltraDock FUDv6 blocks the write commands from being received by the attached drive, while the operating system caches the data in memory and clears it after disconnection.

Package Contents

Check the package contents to ensure you have received the following items:

• Forensic UltraDock FUDv6 – Quantity: 1
• Power adapter and power cord – Quantity: 1
• USB Type C cable – Quantity: 1

Please contact the manufacturer if any items are missing or damaged.

A6-3135-01 Rev 1.0

©2022 CRU Data Security Group, LLC. ALL RIGHTS RESERVED. WiebeTech® is a trademark owned by CDSG and is protected under trademark law.

Product Warranty: CDSG warrants this product to be free of significant defects in material and workmanship for a period of two (2) years from the original date of purchase. CDSG’s warranty is nontransferable and is limited to the original purchaser.

Limitation of Liability: The warranties set forth in this agreement replace all other warranties. CDSG expressly disclaims all other warranties, including but not limited to, the implied warranties of merchantability and fitness for a particular purpose and non-in-fringement of third-party rights with respect to the documentation and hardware. No CDSG dealer, agent, or employee is authorized to make any modification, extension, or addition to this warranty. In no event will CDSG or its suppliers be liable for any costs of procurement of substitute products or services, lost profits, loss of information or data, computer malfunction, or any other special, indirect, consequential, or incidental damages arising in any way out of the sale of, use of, or inability to use any CDSG product or service, even if CDSG has been advised of the possibility of such damages. In no case shall CDSG’s liability exceed the actual money paid for the products at issue. CDSG reserves the right to make modifications and additions to this product without notice or taking on additional liability.

FCC Compliance Statement: This device complies with Part 15 of the FCC rules. Operation is subject to the following two conditions:(1) This device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation.

This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications.

In the event that you experience Radio Frequency Interference, you should take the following steps to resolve the problem:

1. Ensure that the case of your attached drive is grounded.
2. Use a data cable with RFI reducing ferrites on each end.
3. Use a power supply with an RFI reducing ferrite approximately 5 inches from the DC plug.
4. Reorient or relocate the receiving antenna.

INTRODUCTION

This document shows you how to set up the Forensic UltraDock FUDv6, which allows you to quickly connect bare IDE and SATA drives in a write-blocked mode to a computer without having to install them into a chassis. 512, 512e, and 4K native drives are supported through the 10 Gbps USB 3.2 Gen 2 host interface. You can even detect or remove hidden areas like Device Configuration Overlays (DCOs), Hidden Protected Areas (HPAs), and Accessible Max Address configurations (AMAs) which can all be used to hide additional data on an attached drive. The Forensic UltraDock connects to your computer via a USB Type-C cable. If you need to work with a nonstandard drive there are a variety of adapters available for additional flexibility at wiebetech.com/products/#SATA_and_PATA_Adapters.

SAFETY INFORMATION
Please read the following before handling this product.

1. Do not drop the product, submit it to impact, or pierce it.
2. The circuit boards within this product are susceptible to static electricity. Proper grounding is strongly recommended to prevent electrical damage to the product or other connected devices, including the computer host.
3. Avoid placing this product close to magnetic devices, high voltage devices, or in an area exposed to heat, flame, direct sunlight, dampness, moisture, rain, vibration, shock, dust, or sand.
4. To avoid overheating, this product should be operated in a well-ventilated area.
5. Remove the drives before transporting the product to prevent damage to the drive interfaces.
6. A damaged cable or device may malfunction and/or overheat and become a fire hazard.

HOW WRITE-BLOCKING WORKS
Write-blocking works through a process known as spoof writing. When you copy files to a write-blocked drive, your operating system appears to successfully write the files to the drive. However, the files are not actually written to the drive. When you disconnect and reconnect the drive, you will see that the files you copied have disappeared.
The reason is because while your operating system sends the data and commands to write that data to the drive, the Forensic UltraDock FUDv6 blocks those commands from being received by the attached drive. Your operating system doesn’t know this, so it acts like it has written the files to the drive (caches the data in memory) and forgets they are there after the drive is disconnected (clears the cached data from memory).

PACKAGE CONTENTS
Check the package contents to verify that you have received the items below. Please contact the manu-facturer if any items are missing or damaged.

IDENTIFYING PARTS

Top

Front

Rear

Side

LED BEHAVIOR

Error

| ****

Red

| ****

Solid

| Lights only if there is a problem with the Forensic UltraDock. Please contact Technical Support (See Section 7: Product Support, page 15).
Drive Activity| Amber| Solid or Blinking| Data is currently being accessed from the attached drive.1
LED Name| Color| State| Description
---|---|---|---

Hidden Area Detection

| ****

Green

| ****

Solid

| Lights only if a Host Protected Area (HPA), Device Configuration Overlay (DCO), or Accessible Max Address configuration (AMA) has been detected on the attached drive.
Power Out| Green| Solid| The Forensic UltraDock is powered on and outputting power to the attached drive.
Power In| Green| Solid| The Forensic UltraDock is connected to power.

1LED behavior depends upon the attached drive’s firmware.

SETUP

1. If you’re attaching an IDE/PATA drive, configure the jumpers on the rear of the drive to Primary/Mas-ter. Consult the instructions on your hard drive’s label. Otherwise, continue on to the next step.

2. Connect the Forensic UltraDock FUDv6 to the drive.

   • IDE/PATA Drives: Connect the IDE ribbon and the Molex Mini-Fit to legacy power cables to the Forensic UltraDock.
   • SATA drives: Connect the Molex Mini-Fit and eSATA ends of the SATA drive attachment cable to the Forensic UltraDock.

3. If you’re using an adapter, connect the drive to the adapter.
   TIP
   WiebeTech offers an array of SATA and PATA adapters to fit different types of drives on wiebetech.com. Visit wiebetech.com/products/#SATA_and_PATA_Adapters

4. Connect an included USB cable from your computer to the USB Type-C port on the rear of the Forensic UltraDock.

5. Connect the included power adapter to the Forensic UltraDock.
   • You may alternatively connect a SATA power cable from the inside of a computer to the SATA Power In port on the side of the Forensic UltraDock.

6. Turn on the power switch.

7. The attached drive will now power on. If a hidden area is detected, the Forensic UltraDock will ask what you would like to do with it. Use the Up or Down buttons to scroll through the options (shown in the table below) and then press Enter to select an option. Back goes back to the previous screen.
   If no hidden area is detected, then you have completed the setup procedure. DCO Found| HPA Found| AMA Found
   ---|---|---
   Keep

DCO – Keeps the DCO

| Keep HPA – Keeps the HPA| Keep AMA – Keeps the AMA
Remove DCO – Removes the DCO, exposing any hidden data within that area| Remove HPA Temp – Temporarily removes the HPA| Remove AMA – Removes the AMA, exposing any hidden data within that area
 | Remove HPA Perm – Permanently removes the HPA|

You are now ready to use the Forensic UltraDock to access the drive.

HOW TO USE THE LCD INTERFACE

Use the LCD and 4-button navigation interface on the top of the Forensic UltraDock FUDv6 to view information about the attached drive. On the 4-button interface, Up and Down allow you to scroll through options, while Enter selects an option and Back goes back to the previous screen.

MENU STRUCTURE

• View Drive Info

  • Drive Temp: Displays the temperature of the attached drive in °C.
  • Capacity (MB): The capacity of the attached drive, measured in megabytes.
  • Manufacturer: The manufacturer of the attached drive.
  • Model number: The model number of the attached drive.
  • Serial number: The serial number of the attached drive.
  • Firmware rev: The firmware revision of the attached drive.
  • HPA size (MB): Displays the size of the host protected area, if any, on the attached drive. Measured in megabytes.
  • DCO size (MB): Displays the size of the device configuration overlay, if any, on the attached drive. Measured in megabytes.
  • AMA size (MB): Displays the size of the accessible max address configuration, if any, on the attached drive. Measured in megabytes.
  • Disk health: The S. M. A. R. T. status of the attached drive.
  • Start/Stops: How many times the attached drive has spun up and spun down.
  • Power cycles: How many power on/off cycles the attached drive has undergone.
  • Bad sectors: The number of bad sectors reported by the attached drive.
  • ATA/ACS Ver: Displays the ATA-ACS command set version used by the attached drive to communi-cate with the host. Includes an option to view a table.

• View Dock Info

  • Product Name: Displays the product’s name
  • Unique ID#: Displays the product’s unique ID number
  • Firmware Ver.#: Displays the product’s current firmware version
  • Mode: Displays whether the Forensic UltraDock is running in Write-Blocked mode or Read-Write mode.

• Set DCO/HPA/AMA

  • Supported in R/W Mode Only: Appears when the Forensic UltraDock is in Write-Blocked mode. The other two sub-menu options are disabled.

  • Set DCO size: Allows you to create a new DCO. If a hidden area if any kind already exists, the Forensic UltraDock will ask if you would like to remove it instead.
    The Forensic UltraDock will indicate that this process will end any data transfer. Press Enter to continue. Press Up or Down to set a new size for the DCO, and then Enter. Press Enter again to confirm the choice. The disk capacity available to a computer will be reduced by this amount. Values exceeding the available capacity will not be accepted.
    Cycle the power on the dock when complete.

  • Set HPA size: Allows you to create a new HPA. If a hidden area if any kind already exists, the Forensic UltraDock will ask if you would like to remove it instead.
    The Forensic UltraDock will indicate that this process will end any data transfer. Press Enter to continue. Press Up or Down to set a new size for the HPA, and then Enter. Press Enter again to confirm the choice. The disk capacity available to a computer will be reduced by this amount. Values exceeding the available capacity will not be accepted.
    Cycle the power on the dock when complete.

  • Set AMA size: Allows you to create a new AMA configuration. If a hidden area of any kind already exists, the Forensic UltraDock will ask if you would like to remove it instead.
    The Forensic UltraDock will indicate that this process will end any data transfer. Press Enter to continue. Press Up or Down to set a new size for the AMA, and then Enter. Press Enter again to confirm the choice. The disk capacity available to a computer will be reduced by this amount. Values exceeding the available capacity will not be accepted.
    Cycle the power on the dock when complete.

DCO, HPA, AND AMA MANAGEMENT

Device Configuration Overlays (DCOs), Hidden Protected Areas (HPAs), and Accessible Max Address Configurations (AMAs) are hidden areas that can be created on a drive. This section helps you create or permanently remove these hidden areas on an attached drive.

CREATE AN DCO, HPA, OR AMA
Follow these instructions to create a new DCO, HPA, or AMA on the attached drive.

IMPORTANT
You will not be able to create a second hidden area if another already exists on the drive.

1. Attach a drive to the Forensic UltraDock FUDv6 and turn the Forensic UltraDock on.

2. The “Select Mode” screen will display on the top LCD panel. Press the Up or Down buttons to select “Read-Write” mode. Then press Enter.

3. Press the Up or Down buttons to navigate to Set DCO/HPA/AMA on the LCD Display menu. Then press Enter.

4. Decide whether you wish to create an DCO, HPA, or AMA.

   • DCO: Use the Up or Down buttons to navigate to Set DCO Size and press Enter.
   • HPA: Use the Up or Down buttons to navigate to Set HPA Size and press Enter.
   • AMA: Use the Up or Down buttons to navigate to Set AMA Size and press Enter.

5. A screen will appear indicating that data transfers will stop if you continue. Press Enter to continue.

6. Press Up or Down to set a new size for the new hidden area. Then press Enter to confirm the choice.
   NOTE
   Values exceeding the available capacity will not be accepted.

7. On the “Are you sure?” screen, press Enter to create the hidden area.

8. Once the hidden area is created, turn the dock off and back on again.

REMOVE A DCO, HPA, OR AMA
Follow these instructions to permanently unhide and remove a hidden area on the attached drive.

1. Set up a drive with the Forensic UltraDock FUDv6 using the steps found in Setup. If a drive is already setup and connected, then just turn the Forensic UltraDock off.
2. Turn on the power switch.
3. The “Select Mode” screen will display on the top LCD panel. Press the Up or Down buttons to select between “Write-Blocked” or “Read-Write” modes and then press Enter. “Write-Blocked” will always be the default mode.
4. If a hidden area is detected, the Forensic UltraDock will ask what you would like to do with it. Use the Up and Down buttons to select an option and then press Enter.
   • If a DCO is found, choose “Remove DCO” to permanently unhide the DCO.
   • If an HPA is found, choose “Remove HPA Perm” to permanently unhide the HPA, or “Remove HPA Temp” to temporarily unhide the HPA. The HPA will be hidden again once the drive is power cycled.
   • If an AMA is found, choose “Remove AMA” to permanently unhide the AMA.
     Permanently removing a hidden area will expose any data within that area.

FORENSIC SOFTWARE UTILITY

The Forensic UltraDock FUDv6 is compatible with the Forensic Software Utility application. This software allows you to perform a write-block test on your Forensic UltraDock, display details about attached drives, and save that data to a file for easy inclusion in a case report.
Download it here: wiebetech.com/software/forensic-software- utility
Follow these instructions to use the Forensic UltraDock with the Forensic Software Utility.

1. Connect an included USB cable from your computer to the USB Type-C port on the rear of the Forensic UltraDock.
2. Turn on the Forensic UltraDock.
3. Open the Forensic Software Utility application.

PRODUCT SUPPORT

Your investment in WiebeTech products is backed up by our free technical support for the lifetime of the product. Contact us through our website, wiebetech.com/support or call us at 1-360-816-1800.

APPENDIX A. TECHNICAL SPECIFICATIONS

~5 Gbps)
Supported Storage Media| •     3.5-inch IDE/PATA hard drives

•     2.5-inch SATA hard drives and SSDs

•     3.5-inch SATA hard drives

Supported via WiebeTech SATA and PATA adapters: 1

•     2.5-inch IDE/PATA hard drives (with PATA Adapter 25)

•     Hitachi 1.8-inch drives (with PATA Adapter 25)

•     Toshiba 1.8-inch drives (with PATA Adapter 18-TOSH)

•     MacBook Air 2010 (with SATA Adapter MBA2010)

•     mSATA (with SATA Adapter mSATA)

•     Mini-PCIe PATA (with PATA Adapter mPCIe)

•     Mini-PCIe SATA (with PATA Adapter mPCIe)

•     Mini PCIe USB (with PATA Adapter mPCIe)

Sector Size Compatibility| SATA 512n and 512e type drives (incompatible with 4Kn type drives)
Data Connectors| One (1) USB 3 Type-C connector
Power Connectors| •     One (1) barrel connector

•     One (1) SATA power connector

Supported Operating Systems| •     Windows 11, 10, and 8.1\

•     macOS 10.15 “Catalina” or newer

•     Red Hat Enterprise Linux and Ubuntu LTS

Weight| 0.18 g
Dimensions| •     Width: 110 mm

•     Length: 75 mm

•     Height: 27 mm

Compliance| •     EMI Standard: FCC Part 15 Class A

•     EMC Standard: EN55022, EN55024

•     CE, RoHS, RCM

1You can find these adapters available for sale at wiebetech.com/products/#SATA_and_PATA_Adapters

Read User Manual Online (PDF format)

Read User Manual Online (PDF format)  >>

Download This Manual (PDF format)

Download this manual  >>