Software Write Bloc...
 
Notifications
Clear all

Software Write Blocker Box

2 Posts
2 Users
0 Likes
698 Views
(@thefuf)
Posts: 262
Reputable Member
 

so i'm writing a simple GUI for dcfldd

There is no need to include an imaging tool in the write blocker. Are you trying to make an imager instead?

Also, dcfldd is a bad choice, it will likely misalign sectors in the destination after a bad sector is encountered in the source. This was confirmed by NIST (PDF) (and by me after the source code review). Also, dcfldd may run into an infinite loop in some situations. Use dc3dd instead!

I know software write blockers have to be tested and hardware write blockers are safer but if i can make it really simple, like a single purpose machine, i believe it can work.

Do you trust software write blockers?

That depends. Some forensic live distributions reportedly include a write blocker, but, in fact, they aren't.

 
Posted : 24/09/2016 3:05 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Well, as a matter if fact "hardware" write blockers like the Tableau and similar are actually "dedicated hardware and dedicated software" write blockers, the sheer fact that they have a firmware and that it is (usually) upgradeable shows their essential nature of "software" hardware 😯 blockers.
http//www.forensicfocus.com/Forums/viewtopic/p=6566642/#6566642

What you are doing is however different, it is a "plain" dcfldd, the issues (if any) will likely come from *anything* outside it, like the kernel drivers and similar, i.e. the actual Linux distro in itself.

As an example (not necessarily your case, of course) there was a small glitch found in OSFclone (seemingly unrelated topic)
http//www.forensicfocus.com/Forums/viewtopic/t=14057/
See also
http//www.forensicfocus.com/Forums/viewtopic/t=12056/

Maybe you want to procure yourself anyway one of these newish and rather convenient hardwares
http//www.forensicfocus.com/Forums/viewtopic/t=10557/
http//www.forensicfocus.com/Forums/viewtopic/p=6583575/#6583575
and experiment with it.

jaclaz

 
Posted : 24/09/2016 3:26 pm
Share: