Computer Forensics in Todays World, - Regarding evidence tampering
Hi Adam,
In the show you mentioned the use of write blocker hardware to dump live volatile data off the machine in question.
My question is doesn't an insert of a USB device of any type write and registry or some bits of data anywhere on the system, thus would violate the integrity of the investigation.
Thanks
Love the show and your efforts
@Christopher-Zaloba,
Christopher,
Thank you for submitting what is an AWESOME question !! The answer is actually fairly straightforward, but it is a question that everyone has when they first hear/learn about write blockers and how they work.
Take a look at the url below, as it will help you out:
http://www.forensicswiki.org/wiki/Write_Blockers
Write Blockers - ForensicsWiki
www.forensicswiki.org
Write blockers are devices that allow acquisition of information on a drive without creating the possibility of accidentally damaging the drive contents.
The short answer to the question is that the write blocker is designed to prevent write commands from being issued back through the interface while allowing read commands through to facilitate access to the target data, but to do so without the ability to modify any attributes of the data in any way.
Regards,
Adam Gordon
Edutainer
Cordially,
Ronnie Wong
Edutainer Manager, ACI Learning [ITPRO]
*if the post has answered the question, mark as solved.
**All "answers" and responses are offered "as is" and my opinion. There is no implied service, support, or guarantee by ITProTV.
