0

In forensics, write blockers devices should block every operation that might change the hard drive content.
Besides the write operation what other operations should a write blocker block?

Improve this question
1
  • @MatthewPeters, not a homework question, i'm new to forensics, that's all (if you want my linkedin profile or something ...)
    – Othman
    Sep 24, 2015 at 20:36

2 Answers 2

Reset to default
1

The concept of a write blocker is to ensure the forensic integrity of a system while simultaneously forensically imaging that system. This is accomplished by permitting read-only operations to a file system, thus a write blocker will prevent all write operations by intercepting them and either translating them into a read operation (if possible) or simply disallowing the write operation.

For instance, a hardware blocker may simply just not include the physical connections for writing (as with USB) and a software write blocker may intercept otherwise write operations -such as disallowing metadata to be changed when viewing an image.

Taken from here:

The United States National Institute of Justice operates a Computer Forensics Tool Testing (CFTT) program which formally identifies the following top-level tool requirements:

  1. A hardware write block (HWB) device shall not transmit a command to a protected storage device that modifies the data on the storage device.

  2. An HWB device shall return the data requested by a read operation.

  3. An HWB device shall return without modification any access-significant information requested from the drive.

  4. Any error condition reported by the storage device to the HWB device shall be reported to the host.

Improve this answer
2
  • Yes, the write operations are blocked, my question is besides the "write" operation what other operations might alter the integrity of the hard drive and hence must be blocked
    – Othman
    Sep 24, 2015 at 20:44
  • Apart from physical disruption (IE hitting the hard drive with a hammer), the only way to alter the integrity is to write in some way to the hard drive. To clarify, a write is essentially the "I" in the "IO model", thus anything can (and should) be blocked...
    – Matthew Peters
    Sep 24, 2015 at 20:48
1

Besides the write operations, there are other operations that might alter the content a hard drive. One of these operations is the "Secure Erase" command: https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase

Improve this answer
2
  • The secure erase command is still (in my opinion) a write operation, just to a different portion of the system -the SDD controller. In any case a proper write blocker (hardware or software) should be able to detect this operation and cancel it.
    – Matthew Peters
    Sep 25, 2015 at 11:46
  • A separate question that you might be interested in is "In what ways can a write blocker be circumvented [by the examiner/examinee]?" or perhaps you are just interested in malware or hacks then "What hacks or malware exist that prevent writeblockers from working properly?" For instance, with your secure erase example there is this which is essentially a failsafe for an SSD.
    – Matthew Peters
    Sep 25, 2015 at 11:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .