12
©2005 Digital Intelligence, Inc.
been stored in the disk cache. A subsequent reboot of the system will clear the
disk cache and show that no changes/modifications were made to the write
protected drive. Pressing “CTRL-C” in MS-DOS will cause the disk cache to be
reset and show this fact as well. Most forensic imaging software uses direct
disk access to read directly from the disk itself, the contents of the operating
system disk cache will not effect the ability to image the disk. (This includes the
“_Restore” directory created by Windows ME).
NTFS Drive Letter Access.
Windows NT/2K/XP may attempt to update (write
to) an NTFS file system the first time the volume it is attached to a system. In
the event that Windows tries to perform this update, the write attempts to the
drive will be blocked. This will prevent Windows from providing logical disk
access to the attached NTFS file system, effectively resulting in an NTFS file
system for which no drive letter is assigned. This condition is a function of the
Windows NT/2K/XP operating system and happens specifically because the
Write Blocker is performing properly. Although logical disk access will not be
provided, the drive will still be able to be forensically imaged at the physical
level.
INT13X (LBA) Support.
Some small drives, which report to support Int13X
(LBA), but do not implement this method correctly, may not function properly
with this device. These drives are typically quite old and always less then 8 GB
in size, and are usually less than 2 GB in size.
Using a FireWire 800 Device with Microsoft Windows.
Microsoft Windows
1394 drivers do not identify which port (1394a or 1394b) is being used when a
multiport FireWire device is attached. Because of this, if two 1394b (800 Mb/s)
capable components (i.e. a controller and a device) are connected via a 1394a
(400 Mb/s) cable, the negotiation speeds of the devices will not be set properly
and the components (controller and device) will not properly establish
communications. When operating in a Microsoft Windows environment, always
use 1394b cables to connect a 1394b capable controller and device.
Microsoft Windows XP Service Pack 2.
With SP2, the performance of
FireWire 800 (1394b) capable devices will be effectively reduced down to the
lowest possible negotiation speed. (Well below that of FireWire 400/1394a
devices). This problem will occur even if the FireWire 800 (1394b) capable
device is attached to a FireWire 400 (1394a) controller or via FireWire 400
(1394a) cables. Only one controller or device on the FireWire chain needs to
be FireWire 800 (1394b) CAPABLE for this problem to occur. Users who install
Windows XP SP2 will notice a severe reduction in performance when using
FireWire to connect 1394b capable devices to the host PC. FireChief has
implemented a firmware "workaround" for the Microsoft's Windows XP SP2
1394/FireWire drivers that allow users to take full advantage of the FireChief.
