Difference between pages "SAFE Boot Disk" and "SAFE Block XP"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Fixed broken link)
 
(Created page with '{{Infobox_Software | name = SAFE Block XP | maintainer = ForensicSoft | os = {{Windows}} | genre = {{Write Blockers}} | license = {{Commercial}} | website = [http…')
 
Line 1: Line 1:
 
{{Infobox_Software |
 
{{Infobox_Software |
   name = SAFE Boot Disk |
+
   name = SAFE Block XP |
 
   maintainer = [[ForensicSoft]] |
 
   maintainer = [[ForensicSoft]] |
 
   os = {{Windows}} |
 
   os = {{Windows}} |
   genre = {{Live CD}} |
+
   genre = {{Write Blockers}} |
 
   license = {{Commercial}} |
 
   license = {{Commercial}} |
   website = [http://www.forensicsoft.com/catalog/products.php http://www.forensicsoft.com/catalog/products.php] |
+
   website = [http://www.forensicsoft.com/catalog/product.php http://www.forensicsoft.com/catalog/product.php] |
 
}}
 
}}
  
The '''System Acquisition Forensic Environment (SAFE) Boot Disk''' is the first and only commercially available forensically sound Windows Boot disk by [[ForensicSoft]]. SAFE is a fully licensed version of Windows PE protected that is protected by the proven [[SAFE Block XP]] software write blocking technology.
+
The '''System Acquisition Forensic Environment (SAFE) Block XP''' software is a software-based write blocker designed for the Windows XP 32 and 64 bit operating system. Because it is software based it allows for disk imaging speeds that are significantly faster than imaging in Windows using commercially available hardware-based write blockers. It also allows you to write block as many devices as are connected to the computer. It is application independent and works with all forensic acquisition and analysis software that works on Windows. In order to ensure that you are working forensically sound environment '''SAFE Block XP''' provides automatic write blocking of all directly attached media, including IDE (PATA & SATA), SCSI, FC, SAS, USB, and IEEE1394.  
  
'''SAFE Boot Disk''' now allows you to boot any x86-based computer without the need to remove the drives or worry about the need for special adapters or controller cards. Because '''SAFE Boot Disk''' is based on Windows PE it includes built in driver support as well as the ability to easily install any drivers that may be missing. This also means the '''Safe Boot Disk''' includes built in support for the NTFS file system without the need for third party tools and has the ability to write to NTFS and NTFS compressed file systems, taking advantage of larger partition sizes, larger file size limits and the advantage of native NTFS compression.
+
'''SAFE Block XP''' identifies and provides access to Host Protected Areas (HPAs) and Device Configuration Overlay (DCOs) on IDE (PATA and SATA) disks, connected directly via PATA or SATA controllers. HPAs are temporarily removed and make no permanent modification to the disk configuration, using volatile HPA commands. Since a DCO cannot be removed temporarily, SAFE Block XP preserves all DCO information, allowing safe removal of the DCO or HPA/DCO combination, then upon completion of the acquisition, replacement of the DCO or HPA/DCO combination back to its original state.
  
In order to ensure the '''SAFE Boot Disk''' is a forensically sound Live CD it has the proven write blocking technology used by [[SAFE Block XP]] built in to ensure that upon booting every attached disk and flash device are automatically blocked without any required user interaction. Unlike some of the Linux Live CD's this is true write blocking and not just mounting read-only or not auto-mounting.
+
== Notes ==
  
Finally '''SAFE Boot Disk''' provides access to Host Protected Areas (HPAs) and Device Configuration Overlay (DCOs) on IDE (PATA and SATA) disks, has built in Case Logging and built in tools for exploration, viewing, and simple forensics functions.
+
* '''SAFE Block XP''' has passed all of NIST's Mandatory and Optional Test Assertions, including not allowing a protected drive to be changed, not preventing obtaining any information from or about any drive and not preventing any operations to a drive that is not protected.

Latest revision as of 19:39, 23 September 2009

SAFE Block XP
Maintainer: ForensicSoft
OS: Windows
Genre: Write Blockers
License: Commercial
Website: http://www.forensicsoft.com/catalog/product.php

The System Acquisition Forensic Environment (SAFE) Block XP software is a software-based write blocker designed for the Windows XP 32 and 64 bit operating system. Because it is software based it allows for disk imaging speeds that are significantly faster than imaging in Windows using commercially available hardware-based write blockers. It also allows you to write block as many devices as are connected to the computer. It is application independent and works with all forensic acquisition and analysis software that works on Windows. In order to ensure that you are working forensically sound environment SAFE Block XP provides automatic write blocking of all directly attached media, including IDE (PATA & SATA), SCSI, FC, SAS, USB, and IEEE1394.

SAFE Block XP identifies and provides access to Host Protected Areas (HPAs) and Device Configuration Overlay (DCOs) on IDE (PATA and SATA) disks, connected directly via PATA or SATA controllers. HPAs are temporarily removed and make no permanent modification to the disk configuration, using volatile HPA commands. Since a DCO cannot be removed temporarily, SAFE Block XP preserves all DCO information, allowing safe removal of the DCO or HPA/DCO combination, then upon completion of the acquisition, replacement of the DCO or HPA/DCO combination back to its original state.

Notes

  • SAFE Block XP has passed all of NIST's Mandatory and Optional Test Assertions, including not allowing a protected drive to be changed, not preventing obtaining any information from or about any drive and not preventing any operations to a drive that is not protected.