Read/Write Blockers
Hardware and software read/ write blockers are essential in any forensic investigation as there is a dire need to collect and preserve evidence information. However, it is critically important to know when to select one over the other. Hardware write blockers restrict access capabilities of a computer by limiting its capacity to write on the storage devices on which it is attached (Ellis, 2013). Software write blockers, on the other hand, are installed in the operating system to restrict forensic investigators from altering the data in the machine in which the operating system is installed. While both write blockers perform similar tasks, the hardware write blocker has a higher speed capability compared to the software write blocker.
The recommended read/write blocker is the hardware version. The Tableau – T356789iu Forensic Universal Bridge, for instance, offers an exceptional data acquisition flexibility and supports PCle. This write blocker supports a vast variety of storage devices, including SATA, USB 3, 2.0, and 1.0, IDE, SAS, as well as FireWire 800 and PCle. Hardware write blockers are independent of the operating systems or the software installed in the device analyzed. They are easier to explain to non-technical people in the digital forensics investigation team, provides a clear visual presentation of the ports blocked from writing, and provides numerous ports that can be used to connect numerous types of devices. On the downside, physical read/ write blockers are a hardware addition to the forensics kit and are more or less restricted to the number of ports available on the device.
While software blockers are available in both free and paid versions, their blocking capabilities cannot match those of hardware write blockers. They are hard to explain to the non-technical members of the investigations team and rely on the underlying software and operating system to function. Incorrect configurations or flawed interactions between the software blocker and the operating system can easily render their blocking capacity inadequate and lead to contamination of evidence.
Reference
Ellis, S. (2013). Cyber Forensics. Computer and Information Security Handbook, 573-602. doi: 10.1016/b978-0-12-803843-7.00040-5