LinuxLEO Website and Training Materials - Updated

Computer forensics training and education issues. If you are looking for topic suggestions for your project, thesis or dissertation please post here rather than the general discussion forum.
Go to page Previous 1 , 2

Re: LinuxLEO Website and Training Materials - Updated

Post Posted: Mon Sep 25, 2017 2:59 am

- thefuf

It is possible to create a simple IDE-to-IDE write blocker without firmware (using an FPGA).

Sure, and that is probably the "last" actually hardware writeblocker.

More or less "parallel" allowed that, "serial" not so much.

Though, just as an example, the Read Only version of this adapter is declared to be "hardware only":
www.addonics.com/produ...sau31r.php


WRITE PROTECT version, model: ADSAU31R-WP

All features are identical as the standard version except the WRITE function is disabled. This unique feature ensures absolute protection on any hard drive or SSD against virus contamination or data tampering. It is a great tool for sharing drives containing important data among different users or for forensic application. Drives connecting to this bridge appears as a READ only media, similar to CD or DVD disc.
  • Same features as the standard version except READ only
  • Protect drive against virus contamination or data tempering
  • WRITE disabled at hardware level. No software hacking to circumvent the WRITE PROTECT function
  • No volatile memory
  • Drive appears to OS as READ only device. Options to format, delete and others that alter the content or structure of the drive are all disabled by the OS


I suspect that it instead contains some unmodifiable firmware.Confused

And - but this has nothing to do with the writeblocker and its software or hardware nature - modern (last 10-15 years) storage devices are way too "smart" for a writeblocker to be really-really 100% effective anyway.

It will never happen, of course, but in theory nothing prevents from reprogramming the disk (or SSD or flash) controller to behave differently from what is expected, and possibly even to detect the presence of a write blocker.

jaclaz


- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
    Page 2 of 2
    Go to page Previous 1 , 2




    ± Forensic Focus Partners

    ± Your Account



    Site Members:

    New Today: 0 Overall: 33343
    New Yesterday: 3 Visitors: 251

    ± Follow Forensic Focus

    Forensic Focus Facebook Page Forensic Focus on Twitter Forensic Focus LinkedIn Group Forensic Focus YouTube Channel

    RSS feeds: News Forums Articles

    ± Latest Articles

    ± Latest Webinars


    Build a Mobile Site
    View Site in Mobile | Classic
    Share by: