Hi guys,
I am using a writer blocker from the high tech crime institute with ftk imager 3.0.0.1443. I made a DD image;however, the report does not indicate that a write blocker was used. The write is definitely working because I tried copying a file via windows explorer in XP, and I get a write protect error.
Has anyone experienced this problem? Is there any programs out there that report a write blocker is used in the report after an image is made?
It all depends on what tool you used for acquisition, forensic image format saved, and the type of write blocker that you used. It is not uncommon for it to not report that a write blocker was used.
I don't believe it is possible to get a report after the fact but you still have your documentation, assuming you are documenting everything. Just make sure you described the acquisition setup, the write blocker make and model, and more importantly, the acquisition and verification hashes.
I sure hope that you didn't test if the write blocker was working by attempting to add a file to your suspect media 😉
It all depends on what tool you used for acquisition, forensic image format saved, and the type of write blocker that you used. It is not uncommon for it to not report that a write blocker was used.
I don't believe it is possible to get a report after the fact but you still have your documentation, assuming you are documenting everything. Just make sure you described the acquisition setup, the write blocker make and model, and more importantly, the acquisition and verification hashes.
I sure hope that you didn't test if the write blocker was working by attempting to add a file to your suspect media 😉
hey allend,
lol no my friend, this is a test lab I am conducting. All electronic evidence is for testing purposes not real evidence.
If you use a Tableau write blocker, they have a couple of cool utilities on their site that should give you the reports you desire.