Write blocker

From Wikipedia, the free encyclopedia

A write blocker is a device used in computer forensics to prevent any writes occurring to a hard drive under investigation. Generally the write blocker is placed between the drive under investigation and the computer used to examine the drive. There are two types of write blockers, Native and Tailgate devices.

A Native device is a device that uses the same interface on both sides of the blocker - for example, IDE to IDE, or SCSI to SCSI. A Tailgate device uses different interfaces such as USB to IDE or FireWire to SATA. Hard drive write blocking was invented by Steve Bress and Mark Menz (US patent 6,813,682).

Forensic class hard drive write blockers should also protect the drive beyond write blocking. This would include operating the drive at slower speeds, thus making the drive not work as hard as in high speeds. This is because the drive could be close to failing due to age or other factors.

[edit] See also

• Forensic disk controller