±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 1 Overall: 35530
New Yesterday: 7 Visitors: 116

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

LinuxLEO Website and Training Materials - Updated

Computer forensics training and education issues. If you are looking for topic suggestions for your project, thesis or dissertation please post here rather than the general discussion forum.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2 

Senior Member

Re: LinuxLEO Website and Training Materials - Updated

Post Posted: Sep 25, 17 08:59

- thefuf

It is possible to create a simple IDE-to-IDE write blocker without firmware (using an FPGA).

Sure, and that is probably the "last" actually hardware writeblocker.

More or less "parallel" allowed that, "serial" not so much.

Though, just as an example, the Read Only version of this adapter is declared to be "hardware only":

WRITE PROTECT version, model: ADSAU31R-WP

All features are identical as the standard version except the WRITE function is disabled. This unique feature ensures absolute protection on any hard drive or SSD against virus contamination or data tampering. It is a great tool for sharing drives containing important data among different users or for forensic application. Drives connecting to this bridge appears as a READ only media, similar to CD or DVD disc.
  • Same features as the standard version except READ only
  • Protect drive against virus contamination or data tempering
  • WRITE disabled at hardware level. No software hacking to circumvent the WRITE PROTECT function
  • No volatile memory
  • Drive appears to OS as READ only device. Options to format, delete and others that alter the content or structure of the drive are all disabled by the OS

I suspect that it instead contains some unmodifiable firmware. Confused

And - but this has nothing to do with the writeblocker and its software or hardware nature - modern (last 10-15 years) storage devices are way too "smart" for a writeblocker to be really-really 100% effective anyway.

It will never happen, of course, but in theory nothing prevents from reprogramming the disk (or SSD or flash) controller to behave differently from what is expected, and possibly even to detect the presence of a write blocker.

- In theory there is no difference between theory and practice, but in practice there is. - 

Page 2 of 2
Page Previous  1, 2