Content deleted Content added
→Description: rm some wordy stuff that is unsourced and somewhat unclear |
rejig |
||
Line 1:
[[Image:Portable forensic tableau.JPG|thumb|right|220px|A portable Tableau write-blocker attached to a [[Hard Drive]]]]
A '''forensic disk controller''' or '''hardware write-block device''' is a specialized type of computer [[hard disk controller]] made for the purpose of gaining read-only access to computer [[hard drive]]s without the risk of damaging the drive's contents. The device is named [[forensics|forensic]] because its most common application is for use in investigations where a computer hard drive may contain evidence. Such a controller historically has been made in the form of a [[dongle]] that fits between a computer and an [[Integrated Drive Electronics|IDE]] or [[SCSI]] hard drive, but with the advent of [[Universal Serial Bus|USB]] and [[Serial ATA|SATA]], forensic disk controllers supporting these newer technologies have become widespread.▼
[[File:Disk image tools.jpg|thumb|220px|right|Example of a portable disk imaging device]]
[[File:Forensic tableau.JPG|thumb|220px|right|A Tableau forensic write blocker]]
▲A '''forensic disk controller''' or '''hardware write-block device''' is a specialized type of computer [[hard disk controller]] made for the purpose of gaining read-only access to computer [[hard drive]]s without the risk of damaging the drive's contents. The device is named [[forensics|forensic]] because its most common application is for use in investigations where a computer hard drive may contain evidence.
Hardware write blocking was invented by Mark Menz and Steve Bress (US patent 6,813,682 and EU patent EP1,342,145) The United States [[National Institute of Justice]] operates a Computer Forensics Tool Testing (CFTT) program which formally identifies<ref>http://www.cftt.nist.gov/HWB-ATP-19.pdf</ref> the following top-level tool requirements:▼
Using hardware to protect the hard drive from writes is very important for several reasons. First, many [[operating system]]s, including [[Microsoft Windows|Windows]], may write to any hard disk that is connected to the system. At the very least, Windows will update the [[access time]] for any file accessed, and may write things to the disk unexpectedly - such as creating hidden folders for the [[recycle bin]] or saved hardware configuration. [[Computer virus|Virus]] infections or [[malware]] on the system used for analysis may attempt to infect the disk being inspected. Additionally, the [[NTFS]] file system may attempt to commit or rollback unfinished transactions, and/or change flags on the volume to mark it as "in use". At the worst, undesired files may allocate and overwrite deleted space on the hard disk which may potentially destroy evidence in the form of previously deleted files.▼
Protecting an evidence drive from writes during investigation is also important to counter potential allegations that the contents of the drive were altered during the investigation. Of course, this can be alleged anyway, but in the absence of technology to protect a drive from writes, there is no way for such an allegation to be refuted.▼
▲The United States [[National Institute of Justice]] operates a Computer Forensics Tool Testing (CFTT) program which formally identifies<ref>http://www.cftt.nist.gov/HWB-ATP-19.pdf</ref> the following top-level tool requirements:
*''A hardware write block (HWB) device shall not transmit a command to a protected storage device that modifies the data on the storage device.''
*''An HWB device shall return the data requested by a read operation.''
Line 24 ⟶ 17:
==Uses==
Forensic disk controllers are most commonly associated with the process of creating a [[Disk imaging#Hard drive imaging|disk image]], or acquisition, during [[digital forensic process|forensic analysis]]. Their use is to prevent inadvertent modification of evidence.
▲Using hardware to protect the hard drive from writes is very important for several reasons. First, many [[operating system]]s, including [[Microsoft Windows|Windows]], may write to any hard disk that is connected to the system. At the very least, Windows will update the [[access time]] for any file accessed, and may write things to the disk unexpectedly - such as creating hidden folders for the [[recycle bin]] or saved hardware configuration. [[Computer virus|Virus]] infections or [[malware]] on the system used for analysis may attempt to infect the disk being inspected. Additionally, the [[NTFS]] file system may attempt to commit or rollback unfinished transactions, and/or change flags on the volume to mark it as "in use". At the worst, undesired files may allocate and overwrite deleted space on the hard disk which may potentially destroy evidence in the form of previously deleted files.
▲Protecting an evidence drive from writes during investigation is also important to counter potential allegations that the contents of the drive were altered during the investigation. Of course, this can be alleged anyway, but in the absence of technology to protect a drive from writes, there is no way for such an allegation to be refuted.
==References==
| |||