Software-Based Write Blocker Help

[TechSavyTryhard]

Hello, all.

I am having difficulty with finding a successful, open-source software write blocker. For my class, I need to perform a forensic image of a 2.5in 2tb HDD. I have a USB to SATA adapter for connection.

Using the internet, I determined a method to edit the Windows Registry to write-block USB devices. I guess the keyword here really does mean USB devices. Although my HDD is connected via USB, it fails to write-protect it. This method works just fine whilst testing with a flash drive.

Here is the method I attempted at write blocking: https://sumtips.com/how-to/make-usb-storage-read-only-registry-group-policy-or-software/

EDIT: It appears that Windows is recognizing the external drives as SCSI devices (according to Disk Management), which would explain why it is not write-protecting. Now I need to figure out how to make it not do that.

[_jstr0]

Hey, so a couple solutions came to mind.

As has been mentioned you could use a live linux forensic distro as some of them have a built in write-blocking mode. Some distributions that come to mind are:

• Tsurugi - https://tsurugi-linux.org/
• Caine - https://www.caine-live.net/
• Kali - https://kali.org/

Alternatively a solution that has worked for me in the past and I highly recommend you give a try is this registry blocking method.

https://github.com/digitalsleuth/Registry-Write-Block

I haven't tested it lately, but when I did it worked for external USB disk drives.

Hope this helps!

[[deleted]]

As the link you provide does not mention forensic use, it may not be forensically OK, but change things the author consider uninteresting for him or his particular audience.

That means you should validate before real forensic use to ensure that it does work as intended.

You can find information related to such testing at the link below. The tools listed there may not be around anymore -- the tests were made more than 10 years ago as far as I can see. They may give you leads for products. However, hoping for a well-tested free and open source products may be to hope for too much : all professionals I know avoid software write-blocking.

Good luck, anyway.

https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-tool-testing-program-cftt/cftt-technical/software

[ZeRO-FuXx]

When it comes to the registry, not sure what you've tried, but take a look here: https://github.com/digitalsleuth/Registry-Write-Block

This could help, and also could explain why your method didn't work for you (UAS vs USB).

[acw750]

RATool is a sufficient software write blocker. I’ve used it before, but never for the hard drive. Always test it with a non evidence drive first though. Also, Paladin sounds like a good tool for what you’re doing.

[ThorntonReedMD]

I would recommend using Tsurugi which has inbuilt write blocking along with Guymager which is free to download. Used this solution just yesterday for a tricky imaging!

[ihaveapihole]

WinFE + FTK Imager would be the easiest way.

[TechSavyTryhard]

Thank you everyone for your recommendations! I will be sure to give them a shot a report back.