http://www.encase.com/html/fastbloc_features.html This is the device called fastbloc which is also sold by the same company as Encase. This device will allow you to use encase to view the hard drive (IDE only at this time) in real-time while being in read access only mode. You can also acquire the hard drive without using the encase boot disk. Anyway, hope that helps. Brandon Young ITG Security - Honeywell CISSP, CCSA, CCSE, CCNA, MCSE 1300 W Warner Rd., 1207-6J Tempe, AZ 85284 (480) 592-3988 -----Original Message----- From: Sawyer, John H. [mailto:JSawyerat_private] Sent: Tuesday, January 08, 2002 9:58 AM To: 'forensicsat_private' Subject: Hard drive write blocking in Windows Hey Everyone. I am just learning about computer forensics on Windows platforms. The problem I have run into is not being able to block writes to hard drives while in Windows. I found PDBlock and NTFSDOS (read-only) but they both run in DOS. I have a demo version of EnCase and when it runs, it says the hard drive is not mounted read-only. Are there any utilities that run in Windows or load before Windows so that a drive can be mounted read-only but still accessible to programs such as EnCase? I was hoping to find a utility for Windows instead of mounting the drive read-only in Linux and then using Samba to share the drive to Windows. Thanks in advance, -jhs ------------------------------------------------ John H. Sawyer Computer Support Specialist Environmental Horticulture Dept University of Florida jsawyerat_private ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Wed Jan 09 2002 - 18:27:10 PST