Mr. Sawyer, By design, Windows does not like read only hard drives. For this and some other fundamental reasons, software write-protection is problematic on Windows (any version). Nonetheless, there is at least one company, KOM Networks, which purports to have a software based write-protection solution for Windows 2000. See http://www.komnetworks.com/products/shieldworx/index.html. For analytical work, I would suggest you consider a hardware solution. You can use the read only SCSI/IDE bridge by A Card, http://www.acard.com/eng/product/scside.html, or a read only FireWire/IDE bridge, available from www.forensic-computers.com. Troy Larson Director, Litigation Support Services Attenex Corporation troyat_private ntevidenceat_private -----Original Message----- From: Sawyer, John H. [mailto:JSawyerat_private] Sent: Tuesday, January 08, 2002 8:58 AM To: 'forensicsat_private' Subject: Hard drive write blocking in Windows Hey Everyone. I am just learning about computer forensics on Windows platforms. The problem I have run into is not being able to block writes to hard drives while in Windows. I found PDBlock and NTFSDOS (read-only) but they both run in DOS. I have a demo version of EnCase and when it runs, it says the hard drive is not mounted read-only. Are there any utilities that run in Windows or load before Windows so that a drive can be mounted read-only but still accessible to programs such as EnCase? I was hoping to find a utility for Windows instead of mounting the drive read-only in Linux and then using Samba to share the drive to Windows. Thanks in advance, -jhs ------------------------------------------------ John H. Sawyer Computer Support Specialist Environmental Horticulture Dept University of Florida jsawyerat_private ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Wed Jan 09 2002 - 18:28:17 PST