Forensic RTX :
Thank you for purchasing WiebeTech’s Forensic RTX. Forensic RTX features WiebeTech’s write-blocked technology, quadruple connectivity for each bay, and power/access LEDs all inside of a tough, durable aluminum frame and lid. The latest feature of Forensic RTX is the new front panel, with write-block indication LEDs as well as HPA/DCO detection. Whether in the field or in a lab, Forensic RTX is a must-have for forensic investigators.
Lawyers, forensics investigators, and techs who want to analyze evidence or image drives in the lab or field rely upon the CRU® WiebeTech® RTX®. Use the unit in the lab, or carry it with the heavy-duty handle that allows for easy transport.
This desktop-based storage enclosure allows investigators to examine 3.5″ IDE/PATA or SATA drives in easy-to-use write-blocked bays and copy data onto SATA drives.
Write-blocked drive bays prevent data from being written back to the drive. Using WiebeTech’s proprietary write-block technology offers easy read-only access to suspect hard drives through high speed FireWire 800 (400 compatible), USB 3.0, or eSATA interfaces. WiebeTech’s write-block technology is compatible with forensic acquisition and analysis software. Each bay offers both dual FireWire 800 (400 compatible) and single USB and eSATA ports.
The Forensic RTX also offers TrayFree™ drive-swapping, allowing fast insertion and removal of drives from the enclosure without needing tools.
Various software applications exist which allow a user to create or modify a Host Protected Area (HPA) or Device Configuration Overlay (DCO) table on a hard drive. There are four LEDs on the front of the Forensic RTX which alert you to the presence of Hidden Areas (HPAs or DCOs) on a drive in any of the four bays.
Additional features:
- 1st and 3rd bay is write blocked
- 1st bay is either IDE/PATA or SATA
- 3rd bay is SATA
- 2nd and 4th (SATA) bays are read/write for captured data
- Compatibility with forensic acquisition and analysis software
- All-metal construction
- SATA bays are shock-absorbing for drive protection
- 3-year warranty
- Free US-based customer support
Whether you’re a forensic investigator, technician, or cybersecurity analyst, the CRU WiebeTech Forensic RTX is a necessary part of your toolkit.
Forensic Device User Advisory
We recommend that you perform a final check on this product. Prior to first use, please verify that the write-blocking function of this product is working properly. This is easily done: attach a known good formatted drive, and verify that the drive mounts properly on your computer. Use a drive that has data on it that you are willing to overwrite. Transfer files to the drive. The files will appear to transfer to the drive. Thereafter, unmounts the drive and remount the drive. The files that you wrote to the drive should not appear after the drive is remounted. If they do appear, there is a problem with your forensic device, and you should contact our support department for further instructions.
Q&A
Q: What are HPA and DCO?
A: A Host Protected Area (HPA) and Device Configuration Overlay (DCO) are reserved areas on a hard drive that are not accessible by the BIOS or OS. Data can be hidden behind an HPA or DCO. Forensic RTX will alert you if there is an HPA or DCO so that you are aware of it and can take the necessary steps to retrieve the hidden data. Forensic RTX’s write-block LED will blink if a drive with an HPA or DCO is connected. If the drive does not have an HPA or DCO then the LED will light solid.
Q: Why is it necessary to update the firmware of my WiebeTech forensic device?
A: Firmware relates to the programs and data that control electronic products. Firmware is enhanced over time, usually to add new features or increase compatibility. Updating firmware can improve the functionality and dependability of your product. If your WiebeTech forensic device is utilizing outdated firmware, the WiebeTech Forensic Software Utility can recognize this and implement up to date firmware on your device. See section 5 of this manual for more information.
Q: I’ve attached my Forensic RTX and can see the volume, but it shows up twice. Which one is the real volume?
A: If you are seeing your Forensic RTX volume mounted twice, chances are the unit is connected to the computer using both the eSATA and FireWire connections. When this is the case, the OS may attempt to mount the RTX twice resulting in two volumes appearing. Simply turn off the RTX and unplug one of the connections to resolve the problem.
Q: Why does my eSATA device appear as a Parallel SCSI device in System Profiler?
A: The “Serial ATA” tab in System Profile shows devices attached to the internal SATA bus, but not always devices attached to an eSATA host card. Sometimes these devices will appear under the heading “Parallel SCSI” instead. This is entirely normal and does not indicate a problem with the device or its drivers.
