It's pretty much routine that when you have a computer before you start imaging the drive the first thing you do is use a write blocker to ensure the data cannot be changed.
Write blockers can be used on SSDs, so what about smartphones?
How often is a write blocker used on a seized phone, and if not why not?
Write blockers are used on attaching interfaces. For example if you block a USB port (or SATA, etc.) to be read-only, whatever device you connect to it, writing on it won't be possible.
It doesn't matter if it is a disk, pendrive, phone, tablet, etc.
Write blockers are used on attaching interfaces. For example if you block a USB port (or SATA, etc.) to be read-only, whatever device you connect to it, writing on it won't be possible.
It doesn't matter if it is a disk, pendrive, phone, tablet, etc.
I know what write blockers are and I said in my first post that they CAN be used on SSDs.
My question was why aren't they used on mobile phones to ensure evidence integrity, or are they?
They can be used with SSD )
With phones better ask a real question on a needed task, generally speaking using write blockers with phones is not common.
Mobile acquisition tools are actually run on the device itself (the tools load client APIs to the device, or install small code into the device's RAM during boot (bootloaders), etc) - if these were write blocked it would be impossible. these are developed in such a way where they don't actually write to the memory chips or device, but need to be allowed to install themselves within there ; many also require device settings to be changed (turn of passcode, turn on USB debugging, turn on developer options, etc).
Mobile acquisition tools are actually run on the device itself (the tools load client APIs to the device, or install small code into the device's RAM during boot (bootloaders), etc) - if these were write blocked it would be impossible. these are developed in such a way where they don't actually write to the memory chips or device, but need to be allowed to install themselves within there ; many also require device settings to be changed (turn of passcode, turn on USB debugging, turn on developer options, etc).
Now there's an answer. Thank you!
I know what write blockers are and I said in my first post that they CAN be used on SSDs.
It doesn't seem so ?
http//www.forensicfocus.com/Forums/viewtopic/p=6586406/#6586406
jaclaz
@jaclaz is there any FF post that you don't remember ?! )
Of course there are, that's why I usually search for them, but I do remember the "most relevant" ones, poarticularly if they are very recent.
jaclaz
If there would be a FF most active user prize, you would certainly be one of the winner candidates )