Software and hardware write blockers do the same job. The tool shall not prevent any operations to a drive that is not protected.The tool shall not prevent obtaining any information from or about any drive.The tool shall not allow a protected drive to be changed.NIST‘s general write blocking requirements hold that: A write blocker, when used properly, can guarantee the protection of the data chain of custody. What are write blockers?Ī write blocker is any tool that permits read-only access to data storage devices without compromising the integrity of the data. The second two bullet points refer to software and hardware write blockers. Further, not all drives have the ability to use jumpers. The first bullet point speaks of jumpers, but there may be times when the suspect drive’s jumper settings are not easily accessible. Use a hard disk write block tool to intercept any inadvertent disk writes.Use an operating system and other software that are trusted not to write to the disk unless given explicit instructions.Where possible, set a hardware jumper to make the disk read only.These procedures involve a layered defense against any modifications to the source disk using the following strategies: How can an investigator ensure for certain that his or her evidence is accepted in court?Īccording to the National Institute of Standards and Technology (NIST), the investigator follows a set of procedures designed to prevent the execution of any program that might modify the disk contents. Attorneys, judges and jurors need to feel confident that the information presented in a computer crime case is legitimate. Forensic investigators need to be absolutely certain that the data they obtain as evidence has not been altered in any way during the capture, analysis, and control. Digital evidence can be cited as evidence in nearly every crime category.

Usb write protector