Write blocking is the act of ensuring that the contents of an evidence drive cannot be modified during the scope of an investigation. It allows acquisition of information on a drive without creating the possibility of accidentally damaging the drive contents. Write blockers do this by allowing read commands to pass but by blocking write commands, hence their name. This can be done one of two ways: with either hardware or software write blockers.
In This Tutorial
status of the disk image to read-only.
In this tutorial we will go through the process of creating a write blocked disk image in order to prevent changes in the course of the investigation.
· Write block a disk image file using WinHex
· Write block a disk image file using file properties and read-only.
|image src : winhex free version screenshot|