I have a write blocker but with IDE connection. I want to investigate a sata disk, can i just use a convertor to convert sata disk to IDE, and without compromising the integrity of the evidence?
Hello,francis87.
I think you do not have any problem with a converter to convert into IDE from SATA.
If you worry integrity of the evidence, How would you like to compare each evidence by hash function.
#I'm not good at English. If my English is strange,I'm sorry.
I would certainly test ANY modifications to a write blocker myself before going into the field. Your write block/converter combination may be just enough different from the combination that someone else uses that it would invalidate the end result.
I think the author may be referring to a SATA to IDE bridge; in which case you shouldn't have any problems.
i am not referring to sata to ide bridge. I am actually referring to sata to ide adaptor connecting to my fastbloc-IDE.
I can do a md5 hash before and after each acquisation, but i dont want to change the integrity right after i insert the adaptor.
As BitHead mentioned before, test it yourself. This way you will be able to say what happens. I think, you also should read up on file systems and howhard drives (ATA at least) work and what you write blocking device actually does.
I don't get it. ?
A write blocker either works or it does not.
Let's assume it works on normal ATA/IDE drives.
The standard operation of an ATA/IDE one is
OS write command->IDE bus->IDE write blocker-|Nothing arrives to IDE HD
What happens if you put a converter
OS write command->IDE bus->IDE write blocker-|Nothing arrives to IDE/SATA converter|Nothing arrives at SATA HD
How could it go wrong? ?
jaclaz
The standard operation of an ATA/IDE one is
OS write command->IDE bus->IDE write blocker-|Nothing arrives to IDE HD
But signals do have to arrive at the drive otherwise your exam computer would not recognize the drive. The only thing blocked is writes.
So the question remains does an IDE to SATA converter attached to an IDE Write-Blocker properly block writes to the SATA drive?
I still stand by my original post. The only way to know for certain, with the equipment the OP is using (because someone else might have just one little difference), is to test it.
I know this may not be an option for you but I like using USB write blocking. That way all I need is a shell to attach the device to and those are a dime a dozen.
But signals do have to arrive at the drive otherwise your exam computer would not recognize the drive. The only thing blocked is writes.
Yes, that's why I made the example with
OS write command
I may add these to clarify
OS NON-write command->IDE bus->IDE write blocker->command arrives to IDE HD and reply goes back to OS
OS write command->IDE bus->IDE write blocker nothing goes past it, and, if needed, a reply is generated by the write blocker and sent back to OS
What happens if you put a converter
OS NON-write command->IDE bus->IDE write blocker->Command arrives to IDE/SATA converter->Command arrives at SATA HD and reply goes back to OS
OS write command->IDE bus->IDE write blocker nothing goes past it, and, if needed, a reply is generated by the write blocker and sent back to OS
So the question remains does an IDE to SATA converter attached to an IDE Write-Blocker properly block writes to the SATA drive?
And I simpy cannot imagine how any write command can go past a write blocker, in other words I see whatever is "south" of a write blocker as something that does not receive write commands. ?
This something can be either
a ATA/IDE drive
a ATA/IDE to SATA adapter + a SATA drive
if I understand correctly the way write blockers work, there should be no difference in operation.
I still stand by my original post. The only way to know for certain, with the equipment the OP is using (because someone else might have just one little difference), is to test it.
Sure, that's undoubtedly the safest way. )
jaclaz