Forensic disk controller: Difference between revisions

Revision as of 15:57, 7 March 2011

Revision as of 00:47, 3 June 2011

Line 4:

A '''forensic disk controller''' or '''hardware write-block device''' is a specialized type of computer [[hard disk controller]] made for the purpose of gaining read-only access to computer [[hard drive]]s without the risk of damaging the drive's contents. The device is named [[forensics|forensic]] because its most common application is for use in investigations where a computer hard drive may contain evidence. Such a controller historically has been made in the form of a [[dongle]] that fits between a computer and an [[Integrated Drive Electronics|IDE]] or [[SCSI]] hard drive, but with the advent of [[Universal Serial Bus|USB]] and [[Serial ATA|SATA]], forensic disk controllers supporting these newer technologies have become widespread.

Hardware write blocking was actually not invented by Mark Menz and Steve Bress (US patent 6,813,682 and EU patent EP1,342,145) TheIn Unitedfact, Statesprevious write blocking devices and patents existed prior to the [[Nationalinexplicable Instituteissuance of Justice]]their operatespatent, aincluding Computerthe ForensicsVoom ToolTechnologies, TestingInc. (CFTT)US programpatent which6,345,346 formallyand identifies<ref>http://www.cftt.nisttheir computer forensic analysis device and write blocker the Shadow.gov/ *''A hardware write block (HWB-ATP-19.pdf</ref>) device shall not transmit a command to a protected storage device that modifies the followingdata top-levelon toolthe requirements:storage device.''

*''A hardware write block (HWB) device shall not transmit a command to a protected storage device that modifies the data on the storage device.''

*''An HWB device shall return the data requested by a read operation.''

*''An HWB device shall return without modification any access-significant information requested from the drive.''