.

USB Vs IDE/SATA write blocker

<<

jimbob

Post Mon Jun 02, 2008 6:49 am

USB Vs IDE/SATA write blocker

I'm considering purchasing a write blocker for forensics work and there are quite a few options on the market. Given that each of them comes with a fairly hefty price tag it is tempting to go down the route of buying a USB blocker and some cheap USB drive enclosures.

The question is does usong a USB blocker limit what can be foresically gathered from an IDE/SATA/SCSI disk?

Jimbob
<<

dalepearson

Sr. Member
Sr. Member

Posts: 357

Joined: Thu Nov 09, 2006 10:03 am

Post Sun Jun 22, 2008 5:01 pm

Re: USB Vs IDE/SATA write blocker

This might not be of much help, but when I was building a new Forensic machine in my last company I had heard good things about UltraBlocks devices. I demo'd a UltraBlock (I forget the model), but had some issues with EnCase, so ended up getting an internal Tableau.

I guess my point is, it might be worth seeing if you can get a demo bit of kit to try, as you say they are not cheap so you dont want to make a costly mistake.
<<

robb369

Newbie
Newbie

Posts: 2

Joined: Thu Jul 19, 2007 6:57 pm

Post Sun Jun 22, 2008 9:00 pm

Re: USB Vs IDE/SATA write blocker

While I primarily use a Solo 3 unit for imaging since I pull 2 images at a time... check WiebeTech for their DriveDock line... for $50 bucks, you can't go wrong...

http://www.wiebetech.com/products/USB_DriveDock.php
<<

dalepearson

Sr. Member
Sr. Member

Posts: 357

Joined: Thu Nov 09, 2006 10:03 am

Post Tue Jun 24, 2008 12:06 pm

Re: USB Vs IDE/SATA write blocker

This USB DriveDock looks really good, but it doesnt say if its a write blocker, so I assume it isnt?

If your using one of these, do you use this in conjuction with something to stop data alteration when conducting a forensic investigation.
<<

harky

Newbie
Newbie

Posts: 10

Joined: Wed Dec 19, 2007 4:42 pm

Location: Germantown Hills, IL (seeking relocation to Chicago area)

Post Tue Jun 24, 2008 12:20 pm

Re: USB Vs IDE/SATA write blocker

dalepearson wrote:This USB DriveDock looks really good, but it doesnt say if its a write blocker, so I assume it isnt?


You assume correctly.  However they do have writeblockers which are significantly less expensive than some of the others.  If you go to the WiebeTech homepage and click on the Forensics option in the side menu, you will access their Forensic docks.  Read the features carefully as they vary in terms of which ports are writeblocked and which aren't.  I haven't used any of these, but am keeping them in mind for future purchases.

And I would say that yes, technically you could use a non-write blocked adapter with a software writeblock, but I have always been taught to use a hardware blocker if at all possible.  It seems to me that there are more potential accidents with a software-based writeblocker (such as software crash, or computer reboot resulting in some drive modification prior to the writeblock software starting back up, etc.)
Daniel Harkness
MCSA, MCSE, CCE
MS - CprE and InfAs
BS - CprE
BS - ComS
<<

robb369

Newbie
Newbie

Posts: 2

Joined: Thu Jul 19, 2007 6:57 pm

Post Wed Jun 25, 2008 7:29 pm

Re: USB Vs IDE/SATA write blocker

This was the actual device I meant to point you to:
http://www.wiebetech.com/products/ForensicComboDock.php

I knew I seen one on their site and grabbed the first block I saw... :o

Return to Forensics

Who is online

Users browsing this forum: No registered users and 1 guest

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software