Write Protection of Evidence Media

Write blockers stop any write operation to the storage media under investigation.

Hardware

• specific for each medium interface: ATA, SATA, SCSI, Firewire (IEEE 1394) or USB.

• Stops write operations regardless of the used OS.

• Specialized hardware provides better acquisition performance

• Some hardware works like a proxy and monitors all operations.

• This is the best option, but it is also the most expensive.

Software

• This is the less expensive solution.

• But may be less effective, some apps can bypass the software write-block.