Forensic disk controller: Difference between revisions

Revision as of 11:57, 3 June 2011

Revision as of 13:46, 15 August 2011

Line 4:

A '''forensic disk controller''' or '''hardware write-block device''' is a specialized type of computer [[hard disk controller]] made for the purpose of gaining read-only access to computer [[hard drive]]s without the risk of damaging the drive's contents. The device is named [[forensics|forensic]] because its most common application is for use in investigations where a computer hard drive may contain evidence. Such a controller historically has been made in the form of a [[dongle]] that fits between a computer and an [[Integrated Drive Electronics|IDE]] or [[SCSI]] hard drive, but with the advent of [[Universal Serial Bus|USB]] and [[Serial ATA|SATA]], forensic disk controllers supporting these newer technologies have become widespread.

The United States [[National Institute of Justice]] operates a Computer Forensics Tool Testing (CFTT) program which formally identifies<ref>http://www.cftt.nist.gov/HWB-ATP-19.pdf</ref> the following top-level tool requirements:

Hardware write blocking was actually not first invented by Mark Menz and Steve Bress (US patent 6,813,682 and EU patent EP1,342,145) In fact, previous write blocking devices and related patents existed prior to the filing of and/or issuance of their above referenced U.S. patent, including the Voom Technologies, Inc. US patent 6,345,346 and Voom's computer forensic analysis device and write blocker the Shadow*. *''A hardware write block (HWB) device shall not transmit a command to a protected storage device that modifies the data on the storage device.''

*''A hardware write block (HWB) device shall not transmit a command to a protected storage device that modifies the data on the storage device.''

*''An HWB device shall return the data requested by a read operation.''

*''An HWB device shall return without modification any access-significant information requested from the drive.''