We have worked with the Logicube and we have quite a few units. It works fine for IDE drives and you do not have to have the exact same drive. Its speed is within the range that you are looking for. The Logicube has limited SCSI support(PCMCIA).........as does the Image Masster system. Both of them are very slow when it comes to SCSI about 5mb/sec or something else dreadfully slow. For SCSI and IDE capability I personally use the device made by Corporate Systems.(corpsys.com). it is slower when it comes to IDE but you get both SCSI and IDE in one unit. Cost wise the Corporate Systems unit sell for just about $1000.00 while the Logicube's and the Image Masster products are approximately 50% more. One issue we have come across with Logicube is its tolerance for drives with bad sectors. We have found that the Logicube can't handle them all too well. One plus that the Image Masster seems to have is that in its newest iteration of firmware it claims to be able to detect host protected areas....... I also use two very portable units made by a company in Taiwan. There speed is about the speed of the Corporate Systems devices but it has quite a few pluses. a. It is very small.--it doesn't have its own power supply but it fits in the palm of your hand. b. It handles bad sectors quite well. c. It can image partitions......... d. It costs a lot less--<$400.00 ----- Original Message ----- From: "J Jewitt" <jjewitt2001at_private> To: <forensicsat_private> Sent: Tuesday, June 18, 2002 9:17 AM Subject: Stand-alone Hard Drive Duplicating Devices > > All, > A few months ago, a post came through asking about > forensic duplication devices. I'd like to revisit that > issue. > My organization has a need to be able to quickly > duplicate hard drives for forensic purposes, and we're > now exploring these devices as an option. > We have a system in our forensics lab which uses > Trinux (and soon Biatchux) to duplicate as well, so > those paths have already been explored. > Analysis of the image is typically done using > Encase. Encase can support a raw dd-type image or > capture from the original hard drive. > > These are my requirements: > 1. Support for SCSI and IDE hard drives > 2. Fairly fast duplication (approx 1 G/min) > 3. Claim of forensic-quality capabilities > 4. Methodology does not rely on duplicating to hard > drive with identical geometry. > 5. Source drive write blocking by default. > 6. Nice to have: optional evidence tag printer, hash > or checksum generator. > 7. Must be very portable. > > We've looked at the following products, at their web > site: > > www.ics-iq.com Solo Product Line > www.logicube.com Forensic SF5000 > > Does anyone have EXPERIENCE with a device like the > above, and is willing to recommend it? > > Thanks in advance, > J Jewitt > > > __________________________________________________ > Do You Yahoo!? > Yahoo! - Official partner of 2002 FIFA World Cup > http://fifaworldcup.yahoo.com > > ----------------------------------------------------------------- > This list is provided by the SecurityFocus ARIS analyzer service. > For more information on this free incident handling, management > and tracking system please see: http://aris.securityfocus.com > > ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Fri Jun 21 2002 - 05:29:53 PDT