Difference between pages "Internet Explorer" and "Write Blockers"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Typed URLs)
 
m (added EPOS WriteProtector)
 
Line 1: Line 1:
{{Expand}}
+
'''Write blockers''' are devices that allow acquisition of information on a [[hard drive|drive]] without creating the possibility of accidentally damaging the drive contents. They do this by allowing read commands to pass but by blocking write commands, hence their name.
  
Microsoft Internet Explorer (MSIE) is the default [[Web Browser]] included with [[Microsoft Windows]].
+
There are two ways to build a write-blocker: the blocker can allow all commands to pass from the computer to the drive except for those that are on a particular list. Alternatively, the blocker can specifically block the write commands and let everything else through.
  
== MSIE 4 to 9 ==
+
Write blockers may also include drive protection which will limit the speed of a drive attached to the blocker. Drives that run at higher speed work harder(the head moves back and forth more often due to read errors). This added protection could allow drives that can not be read at high speed (UDMA modes) to be read at the slower modes (PIO).  
MSIE 4 to 9 uses the [[Internet Explorer History File Format]] (or MSIE 4-9 Cache File format). The Cache Files commonly named index.dat are used to store both cache and historical information.
+
  
== MSIE 10 ==
+
There are two types of write blockers, Native and Tailgate. A Native device uses the same interface on for both in and out, for example a IDE to IDE write block. A Tailgate device uses one interface for one side and a different one for the other, for example a Firewire to SATA write block.
  
<pre>
+
Steve Bress and Mark Menz invented hard drive write blocking (US Patent 6,813,682).
C:\Users\%USER%\AppData\Local\Microsoft\Windows\WebCache\
+
</pre>
+
  
To do: confirm if these files are in the [[Extensible Storage Engine (ESE) Database File (EDB) format]]
+
There are both hardware and software write blockers. Some software write blockers are designed for a specific operating system. One designed for Windows will not work on Linux. Most hardware write blockers are software independent.
  
== Configuration ==
+
= Hardware Write Blockers =
Internet Explorer will apply its setting in the following order, where the lower the order overrides settings in the higer order.
+
# Settings in Machine policy key
+
# Settings in User policy key
+
# Settings in User preference key
+
# Settings in Machine preference key
+
  
Machine policy key
+
'''Hardware write blockers''' can be either [[IDE]]-to-IDE or [[Firewire]]/[[USB]]-to-IDE. Simson prefers the IDE-to-IDE because they deal better with errors on the drive and make it easier to access special information that is only accessible over the IDE interface. You may feel differently.
<pre>
+
HKET_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
+
</pre>
+
  
Machine preference key
+
NIST test results are here: http://www.nist.gov/itl/ssd/cs/cftt/cftt-hardware-write-block.cfm
<pre>
+
HKET_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
+
</pre>
+
  
User policy key
+
== Commercial ==
<pre>
+
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
+
</pre>
+
  
User preference key
+
; [[ICS Drive Lock]]
<pre>
+
: http://www.ics-iq.com/Super-DriveLock-Write-Blocker-Write-Protector-p/f.gr-0028-0000.htm
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
+
</pre>
+
  
=== Security Zones ===
+
; MyKey Technology, Inc. NoWrite FPU and FlashBlock II
0 - My Computer
+
: 1.8"/2.5"/3.5"/ IDE to IDE, FireWire/USB to IDE & SATA, all media types - NIST Ver. 2 accepted 
 +
: http://www.mykeytech.com/
  
1 - Local Intranet Zone
+
; [[Tableau]] write blockers for IDE, SATA, SCSI, USB  NIST Ver. 1 accepted
 +
: http://www.tableau.com/index.php?pageid=products
  
2 - Trusted Sites Zone
+
; WiebeTech write-blockers for almost any disk drive: 2.5"/3.5" IDE, SCSI, SATA, ...
 +
: http://wiebetech.com/home.php?home=5  NIST Ver. 1 accepted
  
3 - Internet Zone
+
; EPOS WriteProtector
 +
; http://www.epos.ua/view.php/en/products_epos_write_protector
  
4 - Restricted Sites Zone
+
= Software Write Blockers =
  
5 - Custom
+
'''Software write blockers''' can be either tailored to an individual operating system or can be an independent boot disk. Their main upsides are with ease of use, since they are on a CD and do not require you to open up the case, and speed since they do not become a bottle neck.
  
=== WPAD ===
+
== Commercial ==
TODO
+
  
== Artifacts ==
+
; [[SAFE Block XP]]
=== Typed URLs ===
+
: SAFE Block XP is a software-based write blocker designed for the Windows XP Operating System. It comes in both 32 and 64 bit options. NIST Ver. 1.2 accepted
Internet Explorer stores the cached History (or Address box) entries in the following Windows Registry key [http://support.microsoft.com/kb/157729].
+
: http://www.forensicsoft.com/
<pre>
+
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs
+
</pre>
+
  
== See Also ==
+
; [[MacForensicsLab Write Controller]]
* [[Internet Explorer History File Format|Internet Explorer 4-9 Cache File Format]]
+
: MacForensicsLab Write Controller is a software-based write blocker designed for the Mac OS X operating system.  It runs on both 32 and 64 bit versions of Mac OS X 10.4 or later.
 +
: http://www.macforensicslab.com/ProductsAndServices/index.php?main_page=product_info&cPath=1&products_id=339
  
== External Links ==
+
[[Category:Disk Imaging]]
* [http://kb.digital-detective.co.uk/display/NetAnalysis1/Internet+Explorer+Cache Internet Explorer Cache]
+
* [http://support.microsoft.com/kb/182569 Internet Explorer security zones registry entries for advanced users], by [[Microsoft]]
+
* [http://technet.microsoft.com/en-us/library/cc302643.aspx Troubleshooting Automatic Detection], by [[Microsoft]]
+
* [http://www.microsoft.com/en-us/download/details.aspx?id=11575 Windows Virtual PC VHDs for testing websites with different Internet Explorer versions], by [[Microsoft]]
+
* [http://www.swiftforensics.com/2011/09/internet-explorer-recoverystore-aka.html Internet Explorer RecoveryStore (aka Travelog) as evidence of Internet Browsing activity], by [[Yogesh Khatri]], September 29, 2011
+
* [http://tojoswalls.blogspot.ch/2013/05/java-web-vulnerability-mitigation-on.html Java Web Vulnerability Mitigation on Windows], by Tim Johnson, May 23, 2013
+
 
+
=== Typed URLS ===
+
* [http://crucialsecurityblog.harris.com/2011/03/14/typedurls-part-1/ TypedURLs (Part 1)], by Paul Nichols, March 14, 2011
+
* [http://crucialsecurityblog.harris.com/2011/03/23/typedurls-part-2/ TypedURLs (Part 2)], by Paul Nichols, March 23, 2011
+
* [http://sketchymoose.blogspot.ch/2014/02/typedurls-registry-key.html TypedURLs Registry Key], Sketchymoose's Blog, February 18, 2014
+
 
+
=== Internet Explorer 10 ===
+
* [http://cyberarms.wordpress.com/2012/08/21/windows-8-forensics-internet-cache-history/ Windows 8 Forensics: Internet History Cache], by Ethan Fleisher, August 21, 2012
+
* [http://hh.diva-portal.org/smash/get/diva2:635743/FULLTEXT02.pdf Forensic Analysis of ESE databases in Internet Explorer 10], by Bonnie Malmström & Philip Teveldal, June 2013
+
 
+
[[Category:Applications]]
+
[[Category:Web Browsers]]
+

Revision as of 11:47, 7 May 2014

Write blockers are devices that allow acquisition of information on a drive without creating the possibility of accidentally damaging the drive contents. They do this by allowing read commands to pass but by blocking write commands, hence their name.

There are two ways to build a write-blocker: the blocker can allow all commands to pass from the computer to the drive except for those that are on a particular list. Alternatively, the blocker can specifically block the write commands and let everything else through.

Write blockers may also include drive protection which will limit the speed of a drive attached to the blocker. Drives that run at higher speed work harder(the head moves back and forth more often due to read errors). This added protection could allow drives that can not be read at high speed (UDMA modes) to be read at the slower modes (PIO).

There are two types of write blockers, Native and Tailgate. A Native device uses the same interface on for both in and out, for example a IDE to IDE write block. A Tailgate device uses one interface for one side and a different one for the other, for example a Firewire to SATA write block.

Steve Bress and Mark Menz invented hard drive write blocking (US Patent 6,813,682).

There are both hardware and software write blockers. Some software write blockers are designed for a specific operating system. One designed for Windows will not work on Linux. Most hardware write blockers are software independent.

Hardware Write Blockers

Hardware write blockers can be either IDE-to-IDE or Firewire/USB-to-IDE. Simson prefers the IDE-to-IDE because they deal better with errors on the drive and make it easier to access special information that is only accessible over the IDE interface. You may feel differently.

NIST test results are here: http://www.nist.gov/itl/ssd/cs/cftt/cftt-hardware-write-block.cfm

Commercial

ICS Drive Lock
http://www.ics-iq.com/Super-DriveLock-Write-Blocker-Write-Protector-p/f.gr-0028-0000.htm
MyKey Technology, Inc. NoWrite FPU and FlashBlock II
1.8"/2.5"/3.5"/ IDE to IDE, FireWire/USB to IDE & SATA, all media types - NIST Ver. 2 accepted
http://www.mykeytech.com/
Tableau write blockers for IDE, SATA, SCSI, USB NIST Ver. 1 accepted
http://www.tableau.com/index.php?pageid=products
WiebeTech write-blockers for almost any disk drive
2.5"/3.5" IDE, SCSI, SATA, ...
http://wiebetech.com/home.php?home=5 NIST Ver. 1 accepted
EPOS WriteProtector
http://www.epos.ua/view.php/en/products_epos_write_protector

Software Write Blockers

Software write blockers can be either tailored to an individual operating system or can be an independent boot disk. Their main upsides are with ease of use, since they are on a CD and do not require you to open up the case, and speed since they do not become a bottle neck.

Commercial

SAFE Block XP
SAFE Block XP is a software-based write blocker designed for the Windows XP Operating System. It comes in both 32 and 64 bit options. NIST Ver. 1.2 accepted
http://www.forensicsoft.com/
MacForensicsLab Write Controller
MacForensicsLab Write Controller is a software-based write blocker designed for the Mac OS X operating system. It runs on both 32 and 64 bit versions of Mac OS X 10.4 or later.
http://www.macforensicslab.com/ProductsAndServices/index.php?main_page=product_info&cPath=1&products_id=339