ATTENTION: The new home of the Digital Forensics Wiki is at https://forensicswiki.xyz/. Yeah, it's a silly name, but it was cheap.
This wiki will be going offline permanently in the near future. An exact date will be announced soon. Thank you for being a part of this community.
If you wish to work on the new forensicswiki, please join the Google Group forensicswiki-reborn

Write Blockers

From ForensicsWiki
Revision as of 20:32, 11 September 2006 by JustinL (Talk | contribs) (Commercial Hardware Write Blockers)

Jump to: navigation, search

Write blockers are devices that allow acquisition of information on a drive without creating the possibility of accidentally damaging the drive contents. They do this by allowing read commands to pass but by blocking write commands, hence their name.

There are two ways to build a write-blocker: the blocker can allow all commands to pass from the computer to the drive except for those that are on a particular list. Alternatively, the blocker can specifically block the write commands and let everything else through.

There are both hardware and software write blockers.

Commercial Hardware Write Blockers

Hardware write blockers can be either IDE-to-IDE or Firewire/USB-to-IDE. Simson prefers the IDE-to-IDE because they deal better with errors on the drive and make it easier to access special information that is only accessible over the IDE interface. You may feel differently.

ICS Drive Lock $195
http://www.forensicpc.com/proddetail.asp?prod=DRIVELOCK&cat=13
Tableau write blockers for IDE, SATA, SCSI, USB
http://www.tableau.com/index.php?pageid=products
WiebeTech write-blockers for almost any disk drive
2.5"/3.5" IDE, SCSI, SATA, ...
http://wiebetech.com/home.php?home=5
NoWrite write-blockers for 2.5" / 3.5" / IDE, SATA, PCMCIA, all media types USB/Firewire interface - NIST accepted - Patented $ 250.00
http://www.nowrite.com