Forensic disk controller: Difference between revisions

Content deleted Content added
SieBot (talk | contribs)
m robot Adding: it:Write blocker
m See also: This link was pointing to itself
Line 20:
A disk controller that caches writes in memory presents the appearance to the operating system that the drive is writable, and uses the memory to ensure that the operating system sees changes to the individual disk sectors it attempted to overwrite. It does this by retrieving sectors from the disk if the operating system hasn't attempted to change them, and retrieving the changed version from memory for sectors that have been changed. This method is transparent to and compatible with all operating systems, and ensures that when the device is powered off, the disk remains unchanged and in its original state. Because the operating system's internal state persists only as long as the drive is mounted or powered on, assuming none of the writes were desired there is no adverse consequence to losing the data in the change buffer.
 
 
==See also==
*[[Write blocker]]
 
==References==