I am currently running my forensic workstation as a virtual machine within VMware Workstation 12.5. I chose to do this for multiple reasons, some of which include snapshots to roll back the workstation, ability to test different forensic tools, test OSs for the workstation (Windows vs Linux), etc. Not to mention the cost associated with VMWare Workstation compared to having several machines running different OSs as well as the portability of it all
So far this setup has worked well as test bed for the start of my expedition. There have been a few performance hurdles but nothing that a little patience wouldn’t take care of. However today I ran into an issue that, although I was able to overcome is disappointing to say the least.
Today I received my WiebeTech Forensic UltraDock v5.5 (FUD v5.5) hardware write protector. Previously I had been modifying the registry of my Windows 10 workstation to provide software write blocking for creating forensic clones of USB thumb drives.
Upon unboxing the FUD v5.5 and hooking it up to a test source drive and my laptop via USB 3.0 it instantly showed up on my host computer and was accessible. I then disconnected the FUD v5.5 from my host computer and connected it to my Windows 10 forensic workstation in VMWare Workstation. Nothing happened, no source drive available in Windows or in FTK Imager. However the virtual workstation showed that the FUD v5.5 was connected to the workstation and not the host.
I verified that VMWare Workstation supported USB 3.0, which is supposedly does and that the USB Controller was in USB 3.0 compatibility mode
Long story short after researching online I could find nothing official on why the USB 3.0 interface shouldn’t work with Windows 10. VMWare had an article about USB 3.0 issues with VMWare ESX, however VMWare Workstation was not mentioned.
I finally decided to try connected the Forensic UltraDock via USB 2.0 cable rather than the USB 3.0 cable that was supplied wit the dock. Bingo! Immediately after moving to the USB 2.0 cable the source drive connected to the FUD v5.5 was visible in my virtual forensic workstation both in Windows and in FTK Imager.
This has to be an issue with VMWare Workstation since the supplied USB 3.0 cable worked perfectly with two other physical laptops that I connected it to.
The USB 2.0 cable gets me working for testing but it is a disappointment since I will not benefit from the speed of USB 3.0. I have not given up hope on finding a solution to be able to utilize USB 3.0 in VMWare Workstation 12.5 but for right now it looks like it is 2.0 only.
I will go into more detail on the WiebeTech Forensic UltraDock v5.5 from CRU in upcoming posts. In the mean time you can find out more about the Forensic UltraDock v5.5 Here.