Usb Write Blocker Free Download
Finlay Mange
The makers of the Deepspar Disk Imager recently jumped into the write blocker scene with their Guardonix USB write blocker. They asked me for my opinion and (full disclosure) sent me out a test unit to play with.
If a hard disk drive that contains malware, is connected to a hardware write blocker, that works on the lowest level, can this malware copy itself ,spread on the hardware write blocker or even on the computer/hardware/operation system that it's connected to?My worry is that the malware may prevent me from making an image of the hard disk drive because it can interupt me from doing this in some way.I saw a video with an HWB where the guy could still write to the HDD but only temporarly, so I guess it was only a RAM/cache on the HDD, after a restart it was gone.He could ofc make copies from HDD through HWB to PC HDD/USB stick etc.My worries is that the malware that is on HDD (read only because of HWB) can do that too.
First off although people commonly refer to "Hardware Write Blockers", there really is no such thing with modern disk drives. Many years ago, a hardware write blocker operated at a very low level by cutting the "write-line", making writing impossible. Disk drives haven't worked like that for decades. Current write blockers have firmware that is programmed to refuse to pass on commands known to cause writes. Out of date firmware and/or newer devices may in fact have commands that write but are not blocked. Generally this doesn't happen if they are kept updated, but this is why they are inline write blockers but not technically hardware blockers.
A device that is "write blocked" is still readable. The point is to protect and prevent modification of the device, it does not inhibit copying content (including malware) from the device to your machine to which it is connected. So yes, malware on the blocked device can be written to your other hard drives or USB sticks.
Thumbscrew is my attempt at a poor man's USB write blocker. When used it allows you to quickly enable or disable writing to all USB mass storage devices on your Windows system. In other words, you can use it to make a USB flash drive, hard drive or IDE / SATA drive in an enclosure read only. However, I make no guarantees as to its forensic validity. Still, if your poor and you want to play around with making forensic images of thumb drives and other USB mass storage devices it may come in handy. You will see one of two icons in your system tray to indicate whether or not USB mass storage devices are set to be read only:
2. USB mass storage devices that are already mounted as writeable will stay writeable until they are removed and reinserted. The same applies if you turn off read only protection while a USB mass storage device is active, it will become writable and stay that way until removed and reinserted.
Forensic write blockers prevent the forensic workstation from modifying the source disk. Physical write blockers physically prevent write commands from being sent to the disk, while software write blockers attempt to block writes at the kernel (OS) level. Today we look at three external physical write blockers and how a forensic investigator can use them.
This is my code in IAR to write. The TRUE parameter is simply the repeated start.
I am attempting to write to the address 0x4466 the value 0x00 then read that value back.
Note, I believe I have it working now to initially write and read blocks.
Simply: A write of the command, number of bytes, address then data, followed by a write of the command and sequential read gives me the value I wrote to the registers, 32 bytes at a time.
I don't believe my SMBus Communication is very reliable, however. I am attempting to write to multiple registers and I am getting a set of NACK'ed writes that occur every other ACK'ed write. The NACK'ed writes are random, as well.
Take a look at the following Logic Analyzer.
SAFE Block is the industry standard Windows software write blocker, used by law enforcement and privateindustry throughout the world, and facilitates the quick and safe acquisition, triage and/or analysisof any disk or flash storage media attached directly to your Windows workstation. It is proven to besafe, and significantly faster than hardware write blocking solutions.
SAFE Block provides the ability to simultaneously write block as many disk devices as are connected to a computer without the need for multiple expensive hardware write blocking devices. Attach 20 hard drives and rebuild a RAID all while write-blocked. There is no limit to what you can protect!
SAFE Block provides automatic write blocking of every directly attached flash and disk media,attached with any interface, including IDE (PATA & SATA), SCSI, FC, SAS, M.2, NVMe, USB, USB-Cand IEEE1394. The user controls automatic write blocking policies for fixed and/or removable disks.The user can have SAFE Block remember individual device's blocked or un-blocked status for easeof use on media repeatedly used on a workstation/laptop.
SAFE Block is used throughout the world by law enforcement and is the only Windows software writeblocking tool in the industry that is forensically sound and passes every NIST validation test.Confirm this yourself using the freely available CRU write block validation tooland compare the results with any other software write blocking tool or method available.
With their help, I found an adaptor with SCSI-2 on one side and SCSI-3 on the other. When it arrived, I met up with one of my groupmates at the Digital Archaeology Lab, where the two of us daisy-chained the FRED cables, write blocker, our connector, and the (newly labeled according to our naming convention) drives to see what would happen.
1 Redundant Array of Inexpensive (or Independent) Disks, a storage virtualization method which uses either hardware or software to combine multiple physical drives into a single logical unit, improving read/write speeds and providing redundancy to protect against drive failure. RAID arrays can be set up at a number of levels depending on user need, all of which have their own implications for preservation and data recovery.
There is a significant difference between SSDs and HDDs, and bus-level write blockers (be it SATA, USB, or SAS) which work with HDDs are not effective when used to write-block SSDs. The write blocker will block writes from the host PC, but the data may still change, thanks to how SSD technology works.
Externally, hard drives and SSDs accept read and write requests over the interface. SSDs additionally accept a special TRIM request, indicating that a specific area on the media is no longer in use. The filesystem will typically issue a TRIM request for a content of a deleted file, indicating that it no longer needs data in the area formerly occupied by that now-deleted file.
Internally, a hard drive implements the same read and write requests to the media. The hard drive's ability to write data to a given sector does not depend on the content of that sector. On the contrary, SSDs cannot write data into an arbitrary location. SSD groups sectors into pages (4 KB to 16 KB per page) and further groups pages into blocks (256 KB to 4 MB per block). Reads and writes are page-granular; erase is block-granular. Importantly, pages cannot be overwritten. To write data, an SSD needs a blank page to write to; pages filled with data, even partially, cannot be used. If there are no blank pages, the block of unused pages needs to be erased. To avoid a situation when there are no readily available blank pages, SSDs perform two types of cleanup:
On a hard drive, if a file is deleted or a volume is formatted, the data which was not explicitly overwritten stays on the drive indefinitely. Also, data written to one area of a hard drive does not affect data written to any other area. If you have two partitions, A and B, on a hard drive, and you quick format partition B, the data is still there. The data will still be there even if you write to partition A. As long as you do not touch B, the original data is still there indefinitely1.
Worse yet, all this activity takes place inside the SSD without any request and, in the general case, without any possibility of interference from the host. It does not matter if you have a hardware write blocker and no SATA writes can pass through it - garbage collection and TRIM processing are executed exclusively by the controller inside your SSD.
So if you are imaging an SSD over SATA, the data may change midway or between two imager passes. If you make two images with a write blocker applied, you may find that the two images are different. There is no general way to avoid this short of chip-off dumping. If you read flash memory chips directly, there is nothing the controller can do about it - it is no longer connected to the chips. However, this seems overly expensive and impractical for everyday practical purposes. Just something to keep in mind, especially if you are doing a forensic acquisition.
1 The rule of data recovery, "do not write anything to the physical media you are recovering from", is so general because the interactions on the live volume are complex. You can sometimes write data on the drive you are recovering from without making the situation worse, but it is so hard to figure out when it is safe that you rather don't.
Write blockers are devices that allow acquisition of information ona drive without creating the possibility ofaccidentally damaging the drive contents. They do this by allowing readcommands to pass but by blocking write commands, hence their name.
There are two ways to build a write-blocker: the blocker can allow allcommands to pass from the computer to the drive except for those thatare on a particular list. Alternatively, the blocker can specificallyblock the write commands and let everything else through.
Write blockers may also include drive protection which will limit thespeed of a drive attached to the blocker. Drives that run at higherspeed work harder (the head moves back and forth more often due to readerrors). This added protection could allow drives that can not be readat high speed (UDMA modes) to be read at the slower modes (PIO).
760c119bf3