WiebeTech Forensic UltraDock FUDv6 User manual

Forensic UltraDock FUDv6
User Manual

A6-3135-01 Rev 1.0
©2022 CRU Data Security Group, LLC. ALL RIGHTS RESERVED. WiebeTech® is a trademark owned by CDSG and is protected under
trademark law.
Product Warranty: CDSG warrants this product to be free of significant defects in material and workmanship for a period of two (2)
years from the original date of purchase. CDSG’s warranty is nontransferable and is limited to the original purchaser.
Limitation of Liability: The warranties set forth in this agreement replace all other warranties. CDSG expressly disclaims all other
warranties, including but not limited to, the implied warranties of merchantability and fitness for a particular purpose and non-in-
fringement of third-party rights with respect to the documentation and hardware. No CDSG dealer, agent, or employee is authorized
to make any modification, extension, or addition to this warranty. In no event will CDSG or its suppliers be liable for any costs of
procurement of substitute products or services, lost profits, loss of information or data, computer malfunction, or any other special,
indirect, consequential, or incidental damages arising in any way out of the sale of, use of, or inability to use any CDSG product or
service, even if CDSG has been advised of the possibility of such damages. In no case shall CDSG’s liability exceed the actual money
paid for the products at issue. CDSG reserves the right to make modifications and additions to this product without notice or taking
on additional liability.
FCC Compliance Statement: This device complies with Part 15 of the FCC rules. Operation is subject to the following two conditions:
(1) This device may not cause harmful interference, and (2) this device must accept any interference received, including interference
that may cause undesired operation.
This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC
Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This
equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction
manual, may cause harmful interference to radio communications.
In the event that you experience Radio Frequency Interference, you should take the following steps to resolve the problem:
1. Ensure that the case of your attached drive is grounded.
2. Use a data cable with RFI reducing ferrites on each end.
3. Use a power supply with an RFI reducing ferrite approximately 5 inches from the DC plug.
4. Reorient or relocate the receiving antenna.

Table of Contents
1. Introduction ............................................................................................................................ 4
1.1. Safety Information ........................................................................................................ 4
1.2. How Write-blocking Works ............................................................................................ 4
1.3. Package Contents ........................................................................................................ 4
1.4. Identifying Parts ........................................................................................................... 5
1.5. LED Behavior ............................................................................................................... 6
2. Setup ..................................................................................................................................... 8
3. How to Use the LCD Interface .................................................................................................. 9
4. Menu Structure ...................................................................................................................... 10
5. DCO, HPA, and AMA Management ......................................................................................... 12
5.1. Create an DCO, HPA, or AMA ...................................................................................... 12
5.2. Remove a DCO, HPA, or AMA ...................................................................................... 12
6. Forensic Software Utility ......................................................................................................... 14
7. Product Support ..................................................................................................................... 15
Appendix A. Technical Specifications .......................................................................................... 16
Forensic UltraDock FUDv6 User Manual 3

1. INTRODUCTION
This document shows you how to set up the Forensic UltraDock FUDv6, which allows you to quickly
connect bare IDE and SATA drives in a write-blocked mode to a computer without having to install them
into a chassis. 512, 512e, and 4K native drives are supported through the 10 Gbps USB 3.2 Gen 2 host
interface. You can even detect or remove hidden areas like Device Configuration Overlays (DCOs), Hidden
Protected Areas (HPAs), and Accessible Max Address configurations (AMAs) which can all be used to
hide additional data on an attached drive.
The Forensic UltraDock connects to your computer via a USB Type-C cable. If you need to work
with a nonstandard drive there are a variety of adapters available for additional flexibility at
wiebetech.com/products/#SATA_and_PATA_Adapters.
1.1. SAFETY INFORMATION
Please read the following before handling this product.
1. Do not drop the product, submit it to impact, or pierce it.
2. The circuit boards within this product are susceptible to static electricity. Proper grounding is strongly
recommended to prevent electrical damage to the product or other connected devices, including the
computer host.
3. Avoid placing this product close to magnetic devices, high voltage devices, or in an area exposed to
heat, flame, direct sunlight, dampness, moisture, rain, vibration, shock, dust, or sand.
4. To avoid overheating, this product should be operated in a well-ventilated area.
5. Remove the drives before transporting the product to prevent damage to the drive interfaces.
6. A damaged cable or device may malfunction and/or overheat and become a fire hazard.
1.2. HOW WRITE-BLOCKING WORKS
Write-blocking works through a process known as spoof writing. When you copy files to a write-blocked
drive, your operating system appears to successfully write the files to the drive. However, the files are not
actually written to the drive. When you disconnect and reconnect the drive, you will see that the files you
copied have disappeared.
The reason is because while your operating system sends the data and commands to write that data to
the drive, the Forensic UltraDock FUDv6 blocks those commands from being received by the attached
drive. Your operating system doesn't know this, so it acts like it has written the files to the drive (caches
the data in memory) and forgets they are there after the drive is disconnected (clears the cached data
from memory).
1.3. PACKAGE CONTENTS
Check the package contents to verify that you have received the items below. Please contact the manu-
facturer if any items are missing or damaged.
Item Quantity
Forensic UltraDock FUDv6 1
Power adapter and power cord 1
USB Type C cable 1
Forensic UltraDock FUDv6 User Manual 4

Item Quantity
USB Type-A to Type-C cable 1
SAS/SATA drive attachment cable 1
IDE Cable 1
Molex Mini-Fit to legacy power cable 1
Quick Start Guide 1
1.4. IDENTIFYING PARTS
Top
Write-Blocking
Status LED
Error LED
Hidden Area
Detection LED
Drive Activity LED
Power
Output LED
Power
Input LED
Navigation
Buttons
Power
Switch
LCD Display
Front
Power
Out
IDE Port
eSATA
Port
Forensic UltraDock FUDv6 User Manual 5

Rear
USB Type C Port
Side
Power Supply
Power Port
SATA
Power Port
1.5. LED BEHAVIOR
LED Name Color State Description
Write-Block Green Solid Lights green when Write-Blocked mode is enabled.
Error Red Solid
Lights only if there is a problem with the Forensic
UltraDock. Please contact Technical Support (See
Section 7: Product Support, page 15).
Drive Activity Amber Solid or
Blinking
Data is currently being accessed from the attached
drive.1
Forensic UltraDock FUDv6 User Manual 6

LED Name Color State Description
Hidden Area
Detection Green Solid
Lights only if a Host Protected Area (HPA), Device
Configuration Overlay (DCO), or Accessible Max
Address configuration (AMA) has been detected on
the attached drive.
Power Out Green Solid The Forensic UltraDock is powered on and
outputting power to the attached drive.
Power In Green Solid The Forensic UltraDock is connected to power.
1LED behavior depends upon the attached drive's firmware.
Forensic UltraDock FUDv6 User Manual 7

2. SETUP
1. If you’re attaching an IDE/PATA drive, configure the jumpers on the rear of the drive to Primary/Mas-
ter. Consult the instructions on your hard drive’s label. Otherwise, continue on to the next step.
2. Connect the Forensic UltraDock FUDv6 to the drive.
•IDE/PATA Drives: Connect the IDE ribbon and the Molex Mini-Fit to legacy power cables to the
Forensic UltraDock.
•SATA drives: Connect the Molex Mini-Fit and eSATA ends of the SATA drive attachment cable to
the Forensic UltraDock.
3. If you're using an adapter, connect the drive to the adapter.
TIP
WiebeTech offers an array of SATA and PATA adapters to fit different types of drives
on wiebetech.com. Visit wiebetech.com/products/#SATA_and_PATA_Adapters
4. Connect an included USB cable from your computer to the USB Type-C port on the rear of the
Forensic UltraDock.
5. Connect the included power adapter to the Forensic UltraDock.
• You may alternatively connect a SATA power cable from the inside of a computer to the SATA
Power In port on the side of the Forensic UltraDock.
6. Turn on the power switch.
7. The attached drive will now power on. If a hidden area is detected, the Forensic UltraDock will ask
what you would like to do with it. Use the Up or Down buttons to scroll through the options (shown in
the table below) and then press Enter to select an option. Back goes back to the previous screen.
If no hidden area is detected, then you have completed the setup procedure.
DCO Found HPA Found AMA Found
Keep
DCO – Keeps the DCO
Keep HPA – Keeps the HPA Keep AMA – Keeps the
AMA
Remove DCO – Removes
the DCO, exposing any
hidden data within that
area
Remove HPA Temp –
Temporarily removes the HPA
Remove AMA – Removes
the AMA, exposing any
hidden data within that
area
Remove HPA Perm –
Permanently removes the HPA
You are now ready to use the Forensic UltraDock to access the drive.
Forensic UltraDock FUDv6 User Manual 8

3. HOW TO USE THE LCD INTERFACE
Use the LCD and 4-button navigation interface on the top of the Forensic UltraDock FUDv6 to view
information about the attached drive. On the 4-button interface, Up and Down allow you to scroll through
options, while Enter selects an option and Back goes back to the previous screen.
Forensic UltraDock FUDv6 User Manual 9

4. MENU STRUCTURE
•View Drive Info
•Drive Temp: Displays the temperature of the attached drive in °C.
•Capacity (MB): The capacity of the attached drive, measured in megabytes.
•Manufacturer: The manufacturer of the attached drive.
•Model number: The model number of the attached drive.
•Serial number: The serial number of the attached drive.
•Firmware rev: The firmware revision of the attached drive.
•HPA size (MB): Displays the size of the host protected area, if any, on the attached drive. Measured in
megabytes.
•DCO size (MB): Displays the size of the device configuration overlay, if any, on the attached drive.
Measured in megabytes.
•AMA size (MB): Displays the size of the accessible max address configuration, if any, on the attached
drive. Measured in megabytes.
•Disk health: The S. M. A. R. T. status of the attached drive.
•Start/Stops: How many times the attached drive has spun up and spun down.
•Power cycles: How many power on/off cycles the attached drive has undergone.
•Bad sectors: The number of bad sectors reported by the attached drive.
•ATA/ACS Ver: Displays the ATA-ACS command set version used by the attached drive to communi-
cate with the host. Includes an option to view a table.
•View Dock Info
•Product Name: Displays the product's name
•Unique ID#: Displays the product's unique ID number
•Firmware Ver.#: Displays the product's current firmware version
•Mode: Displays whether the Forensic UltraDock is running in Write-Blocked mode or Read-Write
mode.
•Set DCO/HPA/AMA
•Supported in R/W Mode Only: Appears when the Forensic UltraDock is in Write-Blocked mode. The
other two sub-menu options are disabled.
•Set DCO size: Allows you to create a new DCO. If a hidden area if any kind already exists, the Forensic
UltraDock will ask if you would like to remove it instead.
The Forensic UltraDock will indicate that this process will end any data transfer. Press Enter to
continue. Press Up or Down to set a new size for the DCO, and then Enter. Press Enter again to
Forensic UltraDock FUDv6 User Manual 10

confirm the choice. The disk capacity available to a computer will be reduced by this amount. Values
exceeding the available capacity will not be accepted.
Cycle the power on the dock when complete.
•Set HPA size: Allows you to create a new HPA. If a hidden area if any kind already exists, the Forensic
UltraDock will ask if you would like to remove it instead.
The Forensic UltraDock will indicate that this process will end any data transfer. Press Enter to
continue. Press Up or Down to set a new size for the HPA, and then Enter. Press Enter again to
confirm the choice. The disk capacity available to a computer will be reduced by this amount. Values
exceeding the available capacity will not be accepted.
Cycle the power on the dock when complete.
•Set AMA size: Allows you to create a new AMA configuration. If a hidden area of any kind already
exists, the Forensic UltraDock will ask if you would like to remove it instead.
The Forensic UltraDock will indicate that this process will end any data transfer. Press Enter to
continue. Press Up or Down to set a new size for the AMA, and then Enter. Press Enter again to
confirm the choice. The disk capacity available to a computer will be reduced by this amount. Values
exceeding the available capacity will not be accepted.
Cycle the power on the dock when complete.
Forensic UltraDock FUDv6 User Manual 11

5. DCO, HPA, AND AMA MANAGEMENT
Device Configuration Overlays (DCOs), Hidden Protected Areas (HPAs), and Accessible Max Address
Configurations (AMAs) are hidden areas that can be created on a drive. This section helps you create or
permanently remove these hidden areas on an attached drive.
5.1. CREATE AN DCO, HPA, OR AMA
Follow these instructions to create a new DCO, HPA, or AMA on the attached drive.
IMPORTANT
You will not be able to create a second hidden area if another already exists on the drive.
1. Attach a drive to the Forensic UltraDock FUDv6 and turn the Forensic UltraDock on.
2. The “Select Mode” screen will display on the top LCD panel. Press the Up or Down buttons to select
“Read-Write” mode. Then press Enter.
3. Press the Up or Down buttons to navigate to Set DCO/HPA/AMA on the LCD Display menu. Then
press Enter.
4. Decide whether you wish to create an DCO, HPA, or AMA.
•DCO: Use the Up or Down buttons to navigate to Set DCO Size and press Enter.
•HPA: Use the Up or Down buttons to navigate to Set HPA Size and press Enter.
•AMA: Use the Up or Down buttons to navigate to Set AMA Size and press Enter.
5. A screen will appear indicating that data transfers will stop if you continue. Press Enter to continue.
6. Press Up or Down to set a new size for the new hidden area. Then press Enter to confirm the choice.
NOTE
Values exceeding the available capacity will not be accepted.
7. On the "Are you sure?" screen, press Enter to create the hidden area.
8. Once the hidden area is created, turn the dock off and back on again.
5.2. REMOVE A DCO, HPA, OR AMA
Follow these instructions to permanently unhide and remove a hidden area on the attached drive.
1. Set up a drive with the Forensic UltraDock FUDv6 using the steps found in Setup. If a drive is already
setup and connected, then just turn the Forensic UltraDock off.
Forensic UltraDock FUDv6 User Manual 12

2. Turn on the power switch.
3. The “Select Mode” screen will display on the top LCD panel. Press the Up or Down buttons to select
between “Write-Blocked” or “Read-Write” modes and then press Enter. “Write-Blocked” will always be
the default mode.
4. If a hidden area is detected, the Forensic UltraDock will ask what you would like to do with it. Use the
Up and Down buttons to select an option and then press Enter.
• If a DCO is found, choose "Remove DCO" to permanently unhide the DCO.
• If an HPA is found, choose "Remove HPA Perm" to permanently unhide the HPA, or "Remove
HPA Temp" to temporarily unhide the HPA. The HPA will be hidden again once the drive is power
cycled.
• If an AMA is found, choose "Remove AMA" to permanently unhide the AMA.
Permanently removing a hidden area will expose any data within that area.
Forensic UltraDock FUDv6 User Manual 13

6. FORENSIC SOFTWARE UTILITY
The Forensic UltraDock FUDv6 is compatible with the Forensic Software Utility application. This software
allows you to perform a write-block test on your Forensic UltraDock, display details about attached drives,
and save that data to a file for easy inclusion in a case report.
Download it here: wiebetech.com/software/forensic-software-utility
Follow these instructions to use the Forensic UltraDock with the Forensic Software Utility.
1. Connect an included USB cable from your computer to the USB Type-C port on the rear of the
Forensic UltraDock.
2. Turn on the Forensic UltraDock.
3. Open the Forensic Software Utility application.
Forensic UltraDock FUDv6 User Manual 14

7. PRODUCT SUPPORT
Your investment in WiebeTech products is backed up by our free technical support for the lifetime of the
product. Contact us through our website, wiebetech.com/support or call us at 1-360-816-1800.
Forensic UltraDock FUDv6 User Manual 15

APPENDIX A. TECHNICAL SPECIFICATIONS
Product Name Forensic UltraDock FUDv6
Interface Types & Speeds USB 3.2 Gen 2: up to 10 Gbps (actual transfer speeds ~5 Gbps)
Supported Storage Media • 3.5-inch IDE/PATA hard drives
• 2.5-inch SATA hard drives and SSDs
• 3.5-inch SATA hard drives
Supported via WiebeTech SATA and PATA adapters:1
• 2.5-inch IDE/PATA hard drives (with PATA Adapter 25)
• Hitachi 1.8-inch drives (with PATA Adapter 25)
• Toshiba 1.8-inch drives (with PATA Adapter 18-TOSH)
• MacBook Air 2010 (with SATA Adapter MBA2010)
• mSATA (with SATA Adapter mSATA)
• Mini-PCIe PATA (with PATA Adapter mPCIe)
• Mini-PCIe SATA (with PATA Adapter mPCIe)
• Mini PCIe USB (with PATA Adapter mPCIe)
Sector Size Compatibility SATA 512n and 512e type drives (incompatible with 4Kn type drives)
Data Connectors One (1) USB 3 Type-C connector
Power Connectors • One (1) barrel connector
• One (1) SATA power connector
Supported Operating
Systems
• Windows 11, 10, and 8.1\
• macOS 10.15 “Catalina” or newer
• Red Hat Enterprise Linux and Ubuntu LTS
Weight 0.18 g
Dimensions • Width: 110 mm
• Length: 75 mm
• Height: 27 mm
Compliance • EMI Standard: FCC Part 15 Class A
• EMC Standard: EN55022, EN55024
• CE, RoHS, RCM
1You can find these adapters available for sale at wiebetech.com/products/#SATA_and_PATA_Adapters
Forensic UltraDock FUDv6 User Manual 16