When examining or processing the files on a hard drive, it is extremely important to retain the original file contents and time stamps. Many people don’t realize that just connecting a hard drive to a PC will alter the contents of the hard drive. In order to preserve the original contents of the hard drive, it is important to implement a write blocking mechanism.
Law firm and service bureaus that process native files from hard drives should take the same care as computer forensic examiners. Today, CD’s and DVD’s will not be altered by common electronic discovery and litigation support applications. However, you should be aware that the process that burned the files to the disks most likely altered the original file system timestamps
There are several hardware devices that prevent the source media from being altered. There are also some recent software developments that are effective, more affordable, and provide faster throughput. If you need to purchase a write blocker, here are a few choices to review:
Hardware:
>Tableau
>WeibeTech
>ICS Drive Lock
Software:
>Safe Block XP
As you shop for hardware write blockers, you will find that you need to purchase multiple devices for different types of hard drive, flash or media cards and can easily spend over $1,000. So we were pleased with our recent test of Safe Block XP from Forensic Soft Inc. Safe Block is affordable write blocking software ($219) that runs on Windows XP and allows users to block multiple media types. Additionally, Safe Block XP can provide a significant improvement in copy, deNISTing or imaging speeds because it works at the speed of the native interface. Hardware write blockers can slow down the process and are often limited to a USB or FireWire connection.