Difference between pages "Write Blockers" and "Microsoft Office"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
m (Commercial Hardware Write Blockers)
 
(External Links)
 
Line 1: Line 1:
'''Write blockers''' are devices that allow acquisition of information on a [[hard drive|drive]] without creating the possibility of accidentally damaging the drive contents. They do this by allowing read commands to pass but by blocking write commands, hence their name.
+
{{expand}}
  
There are two ways to build a write-blocker: the blocker can allow all commands to pass from the computer to the drive except for those that are on a particular list. Alternatively, the blocker can specifically block the write commands and let everything else through.
+
== EventLogs ==
 +
As of Office 2010 related Office Alerts EventLog:
 +
<pre>
 +
C:\Windows\System32\winevt\Logs\OAlerts.evtx
 +
</pre>
  
There are both hardware and software write blockers.
+
== See Also ==
 +
* [[Microsoft Office File formats]]
  
= Commercial Hardware Write Blockers =
+
== External Links ==
 +
* [http://dfstream.blogspot.com/2014/01/ms-excel-2013-last-saved-location.html MS Excel 2013 Last Saved Location Metadata], Jason Hale, January 12, 2014
  
'''Hardware write blockers''' can be either [[IDE]]-to-IDE or [[Firewire]]/[[USB]]-to-IDE. Simson prefers the IDE-to-IDE because they deal better with errors on the drive and make it easier to access special information that is only accessible over the IDE interface. You may feel differently.
+
[[Category:Analysis]]
 
+
; ICS Drive Lock $195
+
: http://www.forensicpc.com/proddetail.asp?prod=DRIVELOCK&cat=13
+
 
+
; Tableau write blockers for IDE, SATA, SCSI, USB
+
: http://www.tableau.com/index.php?pageid=products
+
 
+
; Wiebetech write-blockers for 2.5"/3.5" IDE, SCSI, SATA, ...
+
: http://wiebetech.com/includes/home/featuredproduct.php?item=4
+
 
+
; NoWrite write-blockers for 2.5" / 3.5" / IDE, SATA, PCMCIA, all media types USB/Firewire interface - NIST accepted - Patented  $ 250.00
+
: http://www.nowrite.com
+

Latest revision as of 15:26, 13 January 2014

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

EventLogs

As of Office 2010 related Office Alerts EventLog:

C:\Windows\System32\winevt\Logs\OAlerts.evtx

See Also

External Links