Write Blocker

[Trevor Chandler]

Write Blocker - a forensic tool, to prevent the capture or analysis,
device or workstation, from changing data on a target disk or media.

Anyone ever used this tool?

 

[Michael Schmitz]

No. and for demo, they are to expensive.
What i tell in the Courses about this:
Also the Problem is with non-removal Flash Storage: No more useful. (All the Apple Stuff, Microsoft Surface and so on)
Also most Blockers are for IDE, maybe SATA Protocol. but not many for M.2 SSD. (Just found one for around 400 USD for M.2 only):
Link says:
Examine the contents of NVMe SSDs without modifying the contents


And what are you doing when the Files are encrypted with Bitlocker ?
Encrypting the Data to get to the real files is already modifying the Data, which means they are no longer as it should be (aka original).
Also Data would be need to be send to the Harddrive for decryption.
What are you doing when you copy the encrypted data, to decrypt you would need the Bitlocker Recovery Key...-> working with modified data, Hashing will no longer work.
What are you doing with VMs stored on a Machine..
So, HDD Write Blocker are maybe useful on legacy devices, but not for modern systems. IMHO.
You need to grab the Data from the running System..
Had no chance to talk about this with a forensic guy yet..
My 2c

 

[Trevor Chandler]

No. and for demo, they are to expensive.
What i tell in the Courses about this:
Also the Problem is with non-removal Flash Storage: No more useful. (All the Apple Stuff, Microsoft Surface and so on)
Also most Blockers are for IDE, maybe SATA Protocol. but not many for M.2 SSD. (Just found one for around 400 USD for M.2 only):
Link says:
Examine the contents of NVMe SSDs without modifying the contents


And what are you doing when the Files are encrypted with Bitlocker ?
Encrypting the Data to get to the real files is already modifying the Data, which means they are no longer as it should be (aka original).
Also Data would be need to be send to the Harddrive for decryption.
What are you doing when you copy the encrypted data, to decrypt you would need the Bitlocker Recovery Key...-> working with modified data, Hashing will no longer work.
What are you doing with VMs stored on a Machine..
So, HDD Write Blocker are maybe useful on legacy devices, but not for modern systems. IMHO.
You need to grab the Data from the running System..
Had no chance to talk about this with a forensic guy yet..
My 2c

Your 2 cents is just as valuable as my 5 cents, so thank you very much Michael!!!