I am working on a forensics policy which covers several countries. One of the options is to have the user device (laptop, workstation) drive acquired (imaged) locally and perform forensics in another country.
The point I am searching information on is the standard (best case) or the best practices (less good case) for the imaging process.
I would like to understand if the software-only solution is sound enough. The forensic distributions I looked at (CAINE for instance) have only soft blocks, in the sense that there are configured to (hopefully) not allow RW mounts by default. Is this enough?
I saw that there are also attempts to use software write blockers, I am not sure on how accurately they were tested.
The overall question would be: is using a software-only solution to acquire a hard drive image sufficient from a forensics perspective? In practical terms, could someone successfuly claim that since no hardware write-blockers were used, there is a presumption that the disk was modified during the forensics process?