Content deleted Content added
Nick Number (talk | contribs) repaired link(s) to disambiguation pages (you can help); MOS:NOITALQUOTE; updated ref; mdy dates - no objection to changing to dmy if consistent |
description Tags: Reverted Visual edit |
||
Line 21:
==Description==
Forensic disk controllers intercept write commands from the host [[operating system]], preventing them from reaching the drive. Whenever the host [[Bus (computing)|bus]] architecture supports it the controller reports that the drive is read-only. The disk controller can either deny all writes to the disk and report them as failures, or use on-board memory to cache the writes for the duration of the session.
[[File:Sinabis Analytics USB-Writeblocker.jpg|alt=Sinabis Analytics USB-Writeblocker|thumb|A Sinabis Analytics USB-write blocker (with inserted USB device)]]
A disk controller that caches writes in memory presents the appearance to the operating system that the drive is writable, and uses the memory to ensure that the operating system sees changes to the individual disk sectors it attempted to overwrite. It does this by retrieving sectors from the disk if the operating system hasn't attempted to change them, and retrieving the changed version from memory for sectors that have been changed.
| |||