Forensic disk controller: Difference between revisions

Revision as of 04:32, 9 June 2017

Revision as of 01:39, 29 April 2020

Line 4:

[[File:Disk image tools.jpg|thumb|220px|right|Example of a portable disk imaging device]]

[[File:Forensic tableau.JPG|thumb|220px|right|A Tableau forensic write blocker]]

A '''forensic disk controller''' or '''hardware write-block device''' is a specialized type of computer [[hard disk controller]] made for the purpose of gaining read-only access to computer [[hard drive]]s without the risk of damaging the drive's contents. The device is named [[forensics|forensic]] because its most common application is for use in investigations where a computer hard drive may contain evidence. Such a controller historically has been made in the form of a [[dongle]] that fits between a computer and an [[Integrated Drive Electronics|IDE]] or [[SCSI]] hard drive, but with the advent of [[Universal Serial Bus|USB]] and [[Serial ATA|SATA]], forensic disk controllers supporting these newer technologies have become widespread. Steve Bress and Mark Menz invented hard drive write blocking (US Patent 6,813,682). <ref>https://patents.google.com/patent/US6813682B2/en</ref>

The United States [[National Institute of Justice]] operates a Computer Forensics Tool Testing (CFTT) program which formally identifies<ref>http://www.cftt.nist.gov/HWB-ATP-19.pdf</ref> the following top-level tool requirements: