Write blocker on sm...
 
Notifications
Clear all

Write blocker on smartphones?

10 Posts
4 Users
0 Likes
3,381 Views
(@wotsits)
Posts: 253
Reputable Member
Topic starter
 

It's pretty much routine that when you have a computer before you start imaging the drive the first thing you do is use a write blocker to ensure the data cannot be changed.

Write blockers can be used on SSDs, so what about smartphones?

How often is a write blocker used on a seized phone, and if not why not?

 
Posted : 02/12/2016 1:33 am
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

Write blockers are used on attaching interfaces. For example if you block a USB port (or SATA, etc.) to be read-only, whatever device you connect to it, writing on it won't be possible.

It doesn't matter if it is a disk, pendrive, phone, tablet, etc.

 
Posted : 02/12/2016 2:20 am
(@wotsits)
Posts: 253
Reputable Member
Topic starter
 

Write blockers are used on attaching interfaces. For example if you block a USB port (or SATA, etc.) to be read-only, whatever device you connect to it, writing on it won't be possible.

It doesn't matter if it is a disk, pendrive, phone, tablet, etc.

I know what write blockers are and I said in my first post that they CAN be used on SSDs.

My question was why aren't they used on mobile phones to ensure evidence integrity, or are they?

 
Posted : 03/12/2016 2:57 am
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

They can be used with SSD )

With phones better ask a real question on a needed task, generally speaking using write blockers with phones is not common.

 
Posted : 03/12/2016 4:27 am
(@vootz)
Posts: 27
Eminent Member
 

Mobile acquisition tools are actually run on the device itself (the tools load client APIs to the device, or install small code into the device's RAM during boot (bootloaders), etc) - if these were write blocked it would be impossible. these are developed in such a way where they don't actually write to the memory chips or device, but need to be allowed to install themselves within there ; many also require device settings to be changed (turn of passcode, turn on USB debugging, turn on developer options, etc).

 
Posted : 05/12/2016 6:26 pm
(@wotsits)
Posts: 253
Reputable Member
Topic starter
 

Mobile acquisition tools are actually run on the device itself (the tools load client APIs to the device, or install small code into the device's RAM during boot (bootloaders), etc) - if these were write blocked it would be impossible. these are developed in such a way where they don't actually write to the memory chips or device, but need to be allowed to install themselves within there ; many also require device settings to be changed (turn of passcode, turn on USB debugging, turn on developer options, etc).

Now there's an answer. Thank you!

 
Posted : 10/12/2016 5:56 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

I know what write blockers are and I said in my first post that they CAN be used on SSDs.

It doesn't seem so ?
http//www.forensicfocus.com/Forums/viewtopic/p=6586406/#6586406

jaclaz

 
Posted : 10/12/2016 2:21 pm
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

@jaclaz is there any FF post that you don't remember ?! )

 
Posted : 10/12/2016 2:32 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

@jaclaz is there any FF post that you don't remember ?! )

Of course there are, that's why I usually search for them, but I do remember the "most relevant" ones, poarticularly if they are very recent.

jaclaz

 
Posted : 10/12/2016 3:22 pm
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

If there would be a FF most active user prize, you would certainly be one of the winner candidates )

 
Posted : 10/12/2016 3:44 pm
Share: