Tableau External Write Blocker Setup and Forensic Imaging Walkthrough
Forensic write blockers prevent the forensic workstation from modifying the source disk. Physical write blockers physically prevent write commands from being sent to the disk, while software write blockers attempt to block writes at the kernel (OS) level. Today we look at three external physical write blockers and how a forensic investigator can use them.
Note that physical and software write blockers can fail. Test your write blocking solutions for regular and odd use cases, and document your results.
The UltraBlock write blockers were generously loaned by Digital Intelligence, Inc.
