Image
 
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 5 guests online
EH-Net Donations

Enter Amount:
$

Google Ads
EH-Net News Feeds
Latest Additions
Book Recommendations





 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Forensicsarrow USB Vs IDE/SATA write blocker
Ethical Hacker Community Forums
November 23, 2008, 04:18:15 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: ChicagoCon 2-Day Ethical Hacking Conference with MS Blue Hats Oct 31 - Nov 1. Tickets Only $100! www.chicagocon.com/content/view/103/51/
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: USB Vs IDE/SATA write blocker  (Read 3147 times)
0 Members and 1 Guest are viewing this topic.
jimbob
Sr. Member
****
Offline Offline

Posts: 307



View Profile WWW
« on: June 02, 2008, 06:49:37 AM »

I'm considering purchasing a write blocker for forensics work and there are quite a few options on the market. Given that each of them comes with a fairly hefty price tag it is tempting to go down the route of buying a USB blocker and some cheap USB drive enclosures.

The question is does usong a USB blocker limit what can be foresically gathered from an IDE/SATA/SCSI disk?

Jimbob
Logged
dalepearson
Full Member
***
Offline Offline

Posts: 153


View Profile
« Reply #1 on: June 22, 2008, 05:01:31 PM »

This might not be of much help, but when I was building a new Forensic machine in my last company I had heard good things about UltraBlocks devices. I demo'd a UltraBlock (I forget the model), but had some issues with EnCase, so ended up getting an internal Tableau.

I guess my point is, it might be worth seeing if you can get a demo bit of kit to try, as you say they are not cheap so you dont want to make a costly mistake.
Logged

robb369
Newbie
*
Offline Offline

Posts: 2


View Profile
« Reply #2 on: June 22, 2008, 09:00:15 PM »

While I primarily use a Solo 3 unit for imaging since I pull 2 images at a time... check WiebeTech for their DriveDock line... for $50 bucks, you can't go wrong...

http://www.wiebetech.com/products/USB_DriveDock.php
Logged
dalepearson
Full Member
***
Offline Offline

Posts: 153


View Profile
« Reply #3 on: June 24, 2008, 12:06:53 PM »

This USB DriveDock looks really good, but it doesnt say if its a write blocker, so I assume it isnt?

If your using one of these, do you use this in conjuction with something to stop data alteration when conducting a forensic investigation.
Logged

harky
Newbie
*
Offline Offline

Posts: 9

Graduate student seeking Digital Forensics career


View Profile
« Reply #4 on: June 24, 2008, 12:20:42 PM »

This USB DriveDock looks really good, but it doesnt say if its a write blocker, so I assume it isnt?

You assume correctly.  However they do have writeblockers which are significantly less expensive than some of the others.  If you go to the WiebeTech homepage and click on the Forensics option in the side menu, you will access their Forensic docks.  Read the features carefully as they vary in terms of which ports are writeblocked and which aren't.  I haven't used any of these, but am keeping them in mind for future purchases.

And I would say that yes, technically you could use a non-write blocked adapter with a software writeblock, but I have always been taught to use a hardware blocker if at all possible.  It seems to me that there are more potential accidents with a software-based writeblocker (such as software crash, or computer reboot resulting in some drive modification prior to the writeblock software starting back up, etc.)
Logged

Iowa State University
MS Student: CprE and InfAs
BS-CprE & BS-ComS
Graduating: Dec. 2008
robb369
Newbie
*
Offline Offline

Posts: 2


View Profile
« Reply #5 on: June 25, 2008, 07:29:59 PM »

This was the actual device I meant to point you to:
http://www.wiebetech.com/products/ForensicComboDock.php

I knew I seen one on their site and grabbed the first block I saw... Shocked
Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.7 | SMF © 2006-2008, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.052 seconds with 23 queries.
 
Sponsors

cwnp_moto__120x90.gif

Polls
During the most recent election, I:
 
Support EH-Net


Support EH-Net by
Buying all of your
Amazon items using
the search bar above.

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!
Recent Forum Topics
Vote For EH-Net

progenic.com
Click here to Vote!

Sadikhov.com
Top IT Cert Sites

binarica.com
Binarica Logo

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2008 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.