Content deleted Content added
description Tags: Reverted Visual edit |
VulcanSphere (talk | contribs) m Changing short description from "Forensic Hardware Device Prevent Writing" to "Specialised hard disk controller for forensic usage" |
||
| (One intermediate revision by one other user not shown) | |||
Line 1:
{{Short description|
{{Use mdy dates|date=November 2022}}
[[File:Portable forensic tableau.JPG|thumb|right|220px|A portable Tableau write-blocker attached to a [[Hard disk drive|hard drive]]]]
Line 21:
==Description==
Forensic disk controllers intercept write commands from the host [[operating system]], preventing them from reaching the drive. Whenever the host [[Bus (computing)|bus]] architecture supports it the controller reports that the drive is read-only. The disk controller can either deny all writes to the disk and report them as failures, or use on-board memory to cache the writes for the duration of the session.
A disk controller that caches writes in memory presents the appearance to the operating system that the drive is writable, and uses the memory to ensure that the operating system sees changes to the individual disk sectors it attempted to overwrite. It does this by retrieving sectors from the disk if the operating system hasn't attempted to change them, and retrieving the changed version from memory for sectors that have been changed.
| |||