From the course: Cybersecurity Foundations: Computer Forensics

Unlock the full course today

Join today to access over 25,200 courses taught by industry experts.

Understanding the role of write blockers

Understanding the role of write blockers

From the course: Cybersecurity Foundations: Computer Forensics

Start my 1-month free trial Buy for my team

Understanding the role of write blockers

“

- [Instructor] Computer forensics rule number one is not damaging your evidence. Here, the evidence refers to your evidence drive. The risk you're constantly running into is your operating system writing to your evidence drive. One of the countermeasures to keep this from happening is using a writeblocker. There are primarily two different types of writeblockers. The first type is hardware right blockers. This picture shows what a hardware writeblocker looks like. Usually these devices sit between an evidence drive and a forensic workstation. The second type is a software writeblocker, and sometimes it's built into a computer forensic suite like in Case or FTK. You could also accomplish the same writeblocking effect by changing the configuration of your operating system. In addition to writeblocking, there are other factors to consider to protect the viability of your evidence. Physical security or chain of custody is one of…

Contents