Reviewed by Scar de Courcier
Logicube provide a line of write blockers for forensic analysis: Portable, Desktop and Bay. The idea behind the write blocker line is to combine multiple interfaces into one device; in the case of the WriteProtect-Portable, it’s a very small device that nonetheless manages to pack quite a punch!The WriteProtect-Portable includes SATA, USB and PCIE natively, and for investigators who are still encountering IDE drives there is an optional IDE to SATA adapter available as an add-on. The WriteProtect-Desktop allows you to connect multiple devices simultaneously, but with the WriteProtect-Portable you can only connect one at a time. There is a web browser function on the WriteProtect-Portable which is rarely required but can come in handy sometimes; an ethernet port on the side of the device allows for easy internet connection. The device also features a fast SuperSpeed USB 3.0 host connection.
It’s a very compact piece of kit: just six inches by four, and very lightweight. This immediately gives it a competitive edge since with most write blockers you would have to bring several different devices along, whereas the WriteProtect-Portable can do everything you need it to do and is easy to carry around.
On the top left-hand side of the device you will find the LEDs that show what is currently in use; the LEDs on the right-hand side are the host LED and the HPA/DCO, as well as the power light which indicates when the WriteProtect-Portable is on.
To get started, simply connect something to the WriteProtect-Portable; for example, you could connect a SATA SSD to the SATA port. The green LED will blink to show it’s connected; you can then take the USB host and plug that into the computer you’re using.
The disk management function in your computer should automatically take you to the drive you’ve mounted; if you’re using Windows you can find it in Explorer if it doesn’t pop up straight away. You can then use your preferred imaging software to acquire evidence.
The web browser looks similar to what you will be used to if you have used the Falcon NEO or any other Logicube product in the past. Go into the network and enter either an IP address or just the serial number of the device you are using into the web browser’s address bar. You will then see the drive you’ve connected and will be able to find more information about it: serial number, logical sector size, and so on.
Clicking ‘Statistics’ will give you more information about the WriteProtect-Portable you are using, including the serial number, as well as advanced drive statistics for the drive you have connected. In System Settings you can create a user profile and create passwords if required. If you go to ‘System Updates’ it will tel you whether there are any updates available and then you can download these and update your WriteProtect-Portable.
The WriteProtect-Portable comes with various cables and a variety of adaptors are available; for example if you’re working with PCIE you will need an extra PCIE adaptor kit.
In some ways this review was not very easy to write, since the WriteProtect-Portable is such an easy to use product that there isn’t a lot to say about it! It’s a very intuitive piece of kit and works exactly as you’d expect it to. The WriteProtect-Portable seems like an excellent choice for investigators in the field: lightweight and speedy, with the advantage of only needing to bring a single device rather than several, I can see it being an excellent addition to the digital forensic examiner’s toolkit.
Logicube have been creating solutions for hard drive duplication and forensic acquisition since 1993. You can find out more about Logicube and the WriteProtect-Portable on their website.
