Warning: external F...
 
Notifications
Clear all

Warning: external FIREWIRE drives

10 Posts
5 Users
0 Likes
640 Views
turtlecove
(@turtlecove)
Posts: 34
Eminent Member
Topic starter
 

A warning for anyone using external Firewire drives as their target imaging drive. Windows XP seems to have a bug in it's firewire drivers that occasionally, randomly, trashes the drive by deleting the partition table and enough of the beginning of the drive to ruin any chances of an easy recovery of data.

If your original evidence drive is behind a hardware write-blocker then it would be safe. However, if you are imaging TO an external firewire IDE drive every time you run an image you are taking a chance on your data being trashed.

I am currently trying to figure out exactly WHAT combinations of hardware and software this applies to, but it has happened to three different drives and I've found references to it on the net.
I have a firewire/800 capable card so this may or may not be a factor.

I've been using an external Firewire drive as my imaging target so until I figure this out I am going to switch to USB2.0 even though it's half the speed.

Anyone else with positive or negative experience with this, please speak up.

 
Posted : 14/02/2005 10:10 pm
(@gmarshall139)
Posts: 378
Reputable Member
 

There are known issues with firewire 800 and sp2. Take a look at this:

http://fwdepot.com/thestore/newsdesk_info.php/newsdesk_id/58?osCsid=b448df80c18c2bf0d8125a2275e8f3a1

 
Posted : 15/02/2005 8:46 pm
(@fmdsspl1)
Posts: 3
New Member
 

I have had the same issues with USB 2.0 drives in XP SP1. Evidence files on external drive, something goes bad, and now my evidence files are gone. Looking at the drive in hex, the root directory was shifted 14 bytes. I was able to shift them all back and recover everything but after some time and sweat. I now always use a write block in windows on drives with any sort of evidence.

 
Posted : 15/02/2005 9:48 pm
gdominguez
(@gdominguez)
Posts: 3
New Member
 

I have seen this problem several times with FireWre target drives. I am also trying to narrow done the cause. So far I have not had the problem occur enough to have a good feel for offending hadware combinations.

I have found that imaging from a FireWire Write Protection device and writing to image to a FireWire based target drive is slightly slower than if the target drive is connected to an IDE bus or SATA bus.

In another post there was a link that discussed Win SP2 and how they slowed the transfer rate from S800 or S400 down to S100. If you are using FireWire Write Protection products by Tableau you can update the devices to overcome this problem.

Greg

 
Posted : 19/02/2005 5:01 pm
(@akaplan0qw9)
Posts: 69
Trusted Member
 

As I read the Microsoft Fix for this, (256986 Description) they seem to take care of the speed issue with a download and some registry modifications.

I have been using an ICS Drivelock. A few months ago I had a firmware issue with it and they sent me a new unit with two 1394b type connectors and one USB2.

A cardbus for my laptop that arrived by mail on Friday has 2x 1394b and 1x 1394a.

The Maxtor external 250 and 300 GB HDs have one 1394a and one USB2.

At one point I was using both 1394a and USB2.

More recently I stared using 100% USB2. I find that very slow (about 16 GB/hour).

I am building a new machine and making other major imaging changes aimed at speeding up the tempo radically. As a part of that upgrading I had planned to go to 800 FireWire to the extent possible. That is,

1. DriveLock to cardbus via 1394b at both ends.

2. CardBus to Maxtor one of the following:

a. 1394b-> 1394a or

b. 1394a-> 1394a or

c. USB2 (on board)-> USB2

OK,

1. Microsoft's fix should address the speed issue and allow speeds limited to the slower of the connected ports. (True or false)

2. Hookup 2a is safe to experiment with. (True or false)

 
Posted : 08/03/2005 7:02 am
(@gmarshall139)
Posts: 378
Reputable Member
 

Al,

SATA has a potential transfer rate higher yet than 1394b. I believe the real world transfer speeds to be roughly as follows:

USB 2.0: 30 mb/s
1394a: 40 mb/s
1394b: 60-80 mb/s
SATA: 120 mb/s

I would put my storage drives in a SATA drive bay. Your speed is still limited by the acquisition method, but you'll be ready for future advances. Not to mention saving a few bucks on another 1394b bridge. Most motherboards have onboard SATA now. Of course you lose the ability to hot swap but I don't see that as too big an issue for a storage drive.

 
Posted : 08/03/2005 1:49 pm
(@gmarshall139)
Posts: 378
Reputable Member
 

Depending on your laptop specs you will not achieve the highest transfer rates through the cardbus adapter. Still better than 1394a probably, but so far I'm not aware of any notebooks with onboard 1394b. The cardbus (pcmcia) slot is the bottleneck. I'm using the onboard 1394a on my notebook and getting pretty decent results, I can get 40gb in 30 minutes, with another 20 required to verify the image.

 
Posted : 08/03/2005 2:01 pm
turtlecove
(@turtlecove)
Posts: 34
Eminent Member
Topic starter
 

Hmmm….
I was trying to go ALL firewire-b also. But after reading gmarshall's comment about SATA I checked, and there are plenty of SATA cards for laptops, such as this:

http://www.firewire-1394.com/cbsata2-sata-cardbus.htm

Not expensive and even faster than Firewire-b…

 
Posted : 08/03/2005 2:16 pm
(@akaplan0qw9)
Posts: 69
Trusted Member
 

My laptop with the 1394b cardbus is/was a fix for working in the field. I did not realize that SATA external drives could be hooked up to it. I may look into it if I can justify it at a later date.

"Later Date" = A reasonable period of time to demonstrate to the powers that control me, (my wife) that all money that I have spent on hardware for the lab computer I am building, makes sense.

In that regard, I have a number of questions dealing with SATA Internal Drives and Raid. I'm going to start a new thread for that.

 
Posted : 08/03/2005 10:11 pm
(@gmarshall139)
Posts: 378
Reputable Member
 

I'd keep it all firewire for field acquisitions. I thought you were speaking of a desktop unit. The convenience probably warrants it.

 
Posted : 09/03/2005 2:00 am
Share: