Forensic RTX

Additional features:

  • 1st and 3rd bay is write blocked
  • 1st bay is either IDE/PATA or SATA
  • 3rd bay is SATA
  • 2nd and 4th (SATA) bays are read/write for captured data
  • Compatibility with forensic acquisition and analysis software
  • All-metal construction
  • SATA bays are shock-absorbing for drive protection
  • 3-year warranty
  • Free US-based customer support

Whether you’re a forensic investigator, technician, or cybersecurity analyst, the CRU WiebeTech Forensic RTX is a necessary part of your toolkit.

Forensic Device User Advisory

We recommend that you perform a final check on this product. Prior to first use, please verify that the write-blocking function of this product is working properly. This is easily done: attach a known good formatted drive, and verify that the drive mounts properly on your computer. Use a drive that has data on it that you are willing to overwrite. Transfer files to the drive. The files will appear to transfer to the drive. Thereafter, unmounts the drive and remount the drive. The files that you wrote to the drive should not appear after the drive is remounted. If they do appear, there is a problem with your forensic device, and you should contact our support department for further instructions.


Q: What are HPA and DCO?

A: A Host Protected Area (HPA) and Device Configuration Overlay (DCO) are reserved areas on a hard drive that are not accessible by the BIOS or OS. Data can be hidden behind an HPA or DCO. Forensic RTX will alert you if there is an HPA or DCO so that you are aware of it and can take the necessary steps to retrieve the hidden data. Forensic RTX’s write-block LED will blink if a drive with an HPA or DCO is connected. If the drive does not have an HPA or DCO then the LED will light solid.

Q: Why is it necessary to update the firmware of my WiebeTech forensic device?

A: Firmware relates to the programs and data that control electronic products. Firmware is enhanced over time, usually to add new features or increase compatibility. Updating firmware can improve the functionality and dependability of your product. If your WiebeTech forensic device is utilizing outdated firmware, the WiebeTech Forensic Software Utility can recognize this and implement up to date firmware on your device. See section 5 of this manual for more information.

Q: I’ve attached my Forensic RTX and can see the volume, but it shows up twice. Which one is the real volume?

A: If you are seeing your Forensic RTX volume mounted twice, chances are the unit is connected to the computer using both the eSATA and FireWire connections. When this is the case, the OS may attempt to mount the RTX twice resulting in two volumes appearing. Simply turn off the RTX and unplug one of the connections to resolve the problem.

Q: Why does my eSATA device appear as a Parallel SCSI device in System Profiler?

A: The “Serial ATA” tab in System Profile shows devices attached to the internal SATA bus, but not always devices attached to an eSATA host card. Sometimes these devices will appear under the heading “Parallel SCSI” instead. This is entirely normal and does not indicate a problem with the device or its drivers.