In terms of BDPL procedures, 'external hard drives' generally refer to external, integrated storage devices that connect to computers via a USB (Universal Serial Bus) or FireWire interface (as opposed to internal drives with SATA or IDE interfaces). They may employ hard disk drive (HDD) or solid state drive (SSD) technology, and generally have been commercially available since the advent of USB technology in 1994. Note that some larger drives require their own power source to run. 'Thumb' or 'USB Flash' drives that plug into USB ports are also included in this category, as they have generally been used as means to back up or transport data. In some cases, it may be desirable for for the entire drive to be imaged (due to unique dependencies, features, or use of the drive), but that generally content will only be copied from such sources.
(External USB Drive)
(Thumb or USB Flash Drive)
The most common way data is damaged on a USB thumb and external drives is when the drive is interrupted while in use. To prevent this ALWAYS properly unmount the drive before removal (i.e. "Safely Remove Hardware"). Click on the upward arrow icon in the bottom corner of the screen and then select the appropriate drive (should be the Tableau T8u write blocker):
Strong magnetic fields should be avoided; be especially careful when inserting or pulling on these, since they can be easily bent or broken. Note that if shipped, the US Postal Service's irradiation of mail can pose damage to drives.
Applying Barcode Labels
With external drives, it may be possible to apply the barcode label to an unobtrusive place on the back or side of the drive, as below:
Given the small size of USB Flash drives, barcode labels should ideally be applied to an envelope or enclosure made for the drive, as seen in the below picture:
If barcode labels are placed directly on the USB Flash drive, there is a danger that the label will come unattached or interfere with the connection to the write blocker.
External hard drives and USB drives should always be write-protected and must not be plugged directly into a workstation. Instead, use the Tableau T8u Forensic USB 3.0 Bridge (pictured below with a USB Flash drive):
- With the Tableau T8u turned off, plug in the USB device into the appropriate port.
- Connect the Tableau T8u to the workstation with the blue USB 3.0 cable.
- Attach the DC power cable to the Tableau T8u and then plug into an outlet.
- Power on the T8u.
- The lights on the right side of the forensic bridge will indicate the power, connection to the device and workstation, and indicate that write-blocking is activated.
- The device will appear in the Windows File Manager.
- When data on the device is read, the 'Activity' light will glow red.