Forensic disk controller: Difference between revisions

Browse history interactively

← Previous edit

Content deleted Content added

VisualWikitext

Revision as of 22:54, 23 November 2020 edit Citation bot (talk \| contribs) Bots 5,868,506 edits Alter: template type. Add: isbn, publisher, pages, year, title, chapter, jstor, chapter-url, author pars. 1-1. Removed or converted URL. Converted bare reference to cite template. Some additions/deletions were actually parameter name changes. Correct ISBN10 to ISBN13. \| You can use this bot yourself. Report bugs here. \| Suggested by Josve05a \| via #UCB_toolbar ← Previous edit		Latest revision as of 06:45, 30 January 2025 edit undo VulcanSphere (talk \| contribs) Extended confirmed users 22,180 edits m Changing short description from "Forensic Hardware Device Prevent Writing" to "Specialised hard disk controller for forensic usage" Tag: Shortdesc helper
(11 intermediate revisions by 6 users not shown)
Line 1: {{Short description\|Specialised hard disk controller for forensic usage}} [[Image:Portable forensic tableau.JPG\|thumb\|right\|220px\|A portable Tableau write-blocker attached to a [[Hard Drive]]]]▼ {{Use mdy dates\|date=November 2022}} ▲[[~~Image~~File:Portable forensic tableau.JPG\|thumb\|right\|220px\|A portable Tableau write-blocker attached to a [[Hard ~~Drive~~disk drive\|hard drive]]]] [[File:Disk image tools.jpg\|thumb\|220px\|right\|Example of a portable disk imaging device]] [[File:Forensic tableau.JPG\|thumb\|220px\|right\|A Tableau forensic write blocker]] [[File:Forensic disk imager.jpg\|thumb\|220x220px\|A Tableau forensic disk imager]] A '''forensic disk controller''' or '''hardware write-block device''' is a specialized type of computer [[hard disk controller]] made for the purpose of gaining read-only access to computer [[~~hard~~Hard disk drive\|hard drives]]s without the risk of damaging the drive's contents. The device is named [[forensics\|forensic]] because its most common application is for use in investigations where a computer hard drive may contain evidence. Such a controller historically has been made in the form of a [[dongle]] that fits between a computer and an [[Integrated Drive Electronics\|IDE]] or [[SCSI]] hard drive, but with the advent of [[Universal Serial Bus\|USB]] and [[Serial ATA\|SATA]], forensic disk controllers supporting these newer technologies have become widespread. Steve Bress and Mark Menz invented hard drive write blocking (US Patent 6,813,682). <ref>{{Cite web\|url=https://patents.google.com/patent/US6813682B2/en\|title=Write protection for computer long-term memory devices}}</ref> <!-- Bridge kit redirects here --> The United States [[National Institute of Justice]] operates a Computer Forensics Tool Testing (CFTT) program which formally identifies<ref>http://www.cftt.nist.gov/HWB-ATP-19.pdf</ref> the following top-level tool requirements:▼ A device which is installed between a storage media under investigation and an investigator's computer is called a "'''bridge kit'''". The bridge kit has one connector for the storage media and another connector the investigator's computer. It allows the investigator to read, but not alter the device under investigation.<ref name="dhs">{{cite web \|title=Test Results for Hardware Write Block Device: Tableau Forensic SATA/IDE Bridge T35u \|date=October 2018 \|publisher=[[United States Department of Homeland Security]] \|url=https://www.dhs.gov/sites/default/files/publications/Test%20Report_NIST_HWB_Tableau%20Forensic%20SATA-IDE%20Bridge%20T35u_Firmware%20Version%20Sep%2015%202015%2011.19.41_October%202018.pdf \|accessdate=February 23, 2021}}</ref> ''A hardware write block (HWB) device shall not transmit a command to a protected storage device that modifies the data on the storage device.''▼ ''An HWB device shall return the data requested by a read operation.''▼ ▲The United States [[National Institute of Justice]] operates a Computer Forensics Tool Testing (CFTT) program which formally identifies~~<ref>http://www.cftt.nist.gov/HWB-ATP-19.pdf</ref>~~ the following top-level tool requirements: ''An HWB device shall return without modification any access-significant information requested from the drive.''▼ ▲''{{Quote\|A hardware write block (HWB) device shall not transmit a command to a protected storage device that modifies the data on the storage device.'' ''Any error condition reported by the storage device to the HWB device shall be reported to the host.'' ▲''An HWB device shall return the data requested by a read operation.'' ▲*''An HWB device shall return without modification any access-significant information requested from the drive.'' Any error condition reported by the storage device to the HWB device shall be reported to the host.<ref>{{Cite book \|url=https://www.nist.gov/system/files/documents/2017/04/28/CFTT-Booklet-Revised-02012012.pdf \|title=Computer Forensics Tool Testing Handbook \|publisher=[[National Institute of Standards and Technology]] \|page=88 \|date=2012-02-01 \|access-date=2022-11-15}}</ref>}} ==Description==