Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If a hardware blocker cannot be acquired could an investigator use DD without a write blocker, would that be forensically sound?

share|improve this question
up vote 7 down vote accepted

The most important part of the forensic investigation is to prove beyond a doubt the integrity of your evidence.

A good way to do this is to compare the hash of the acquired disk image against the hash of the original disk which should have been taken when the disk is recovered from the crime scene. Said hash should most probably be on the chain of custody form.

If a hardware write blocker cannot be used, I would suggest booting the system in question into a live Linux CD that mounts the disk in read-only mode. A forensics live CD like Helix can do this automatically.

Instead of using the standard dd tool, I would suggest dcfldd, a version of dd specifically for forensics use. It has a bunch of features useful for forensics investigation that the standard dd tool does not, such as on-the-fly hashing.

share|improve this answer
Your first sentence is missing something – BrianAdkins Apr 13 '13 at 17:17
@BrianAdkins Blah, thanks. Fixed that. – Terry Chia Apr 13 '13 at 17:18
Perfect, thank you. I was not sure if the live cd interfaced with the hard drive in a forensically unsound manner. – Ninja2k Apr 13 '13 at 17:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.