Hard Drive Write Blocker

From: Erin Kenneally (erinat_private)
Date: Tue May 22 2001 - 18:09:04 PDT

  • Next message: daniel heinonen: "forensics: Assignment outline"

    Increasing interest has been expressed by the computer forensic community in
    obtaining a hard drive write-blocking device.  For those of you who were
    able to see demos of this device at the San Diego RCFL (Regional Computer
    Forensic Lab) last Fall, we pledged to make ordering information available
    as soon as the manufacturer completed the suggested forensic enhancements to
    the device.  
    
    In a nutshell, this adapter is hardware-based and thus works at the physical
    level to block writes to IDE drives.  The adapter simply accepts all 'write'
    commands but fails to act upon them.  Specifically, all 'write' commands are
    trapped through the SCSI command set.  Furthermore, the recent modifications
    in the firmware continues to block write commands, but reports (spoofs) an
    acknowledgement to the contrary- i.e., that it has written the requested
    data- to the requesting application. This allows many Windows backup/imaging
    programs to continue, without failure -- whereas most will hang after not
    receiving a signal that the 'write' was completed.
    
    The device is available from Acard Technology only in its "raw" state, and
    it is up to the user to provide the  necessary power connection and
    enclosure, if desired.
    
    We believe that this adapter will be useful to many, however, like most
    products, will evolve from this first iteration.   So we encourage you to
    make suggestions for possible enhancements.  In turn, Acard Technology has
    pledged that they will make these enhancements available to all.  
    
    After collaborating with the manufacturer to ensure that this device is made
    widely available to professionals in the computer forensic arena, below is
    the manufacturer's contact information for direct ordering.  The
    manufacturer has confirmed a pricing arrangement whereby the device
    (AEC-7720UW) can be ordered for $70 USD for quantities under 500; and, $60
    USD for orders exceeding 500 units.  Also, sample orders are available at
    $99 USD.  All price terms are FOB Taiwan. 
    
    
    Acard Technology Corp. 
    Attn:  Sophia Kuo 
    Add : 6F, No. 78, Sec 1 Kuwang Fu Road, 
    Sanchung, Taipei Hsien, Taiwan. 
    Tel  : 886-2-8512 2290 ext#210 
    Fax : 886-2-8512 2548 
    Web site: www.acard.com 
    
    
    We feel that the members of the computer forensics community should have the
    opportunity to acquire this device at a price that is reflective of the
    actual cost at which the manufacturer is willing to make it available.
    
    The dissemination of this information is not tied to any commercial or
    proprietary interests or endorsements, but rather, is aimed at facilitating
    the widest possible availability of a valuable tool among the computer
    forensics community.    
    
    John F. Gunn
    Director
    Regional Computer Forensics Laboratory (RCFL)
    San Diego
    researchat_private
    
    Erin Kenneally, M.F.S., J.D.
    Forensic Analyst
    San Diego Supercomputer Center 
    San Diego
    erinat_private
    



    This archive was generated by hypermail 2b30 : Wed May 23 2001 - 17:09:23 PDT