RE: Converting an external hard drive enclosure into a write blocker?

"Robinson, Sonja" <[email protected]> Mon, 26 Nov 2007 16:13:03 -0500
Newsgroups gmane.comp.security.forensics
Message-ID <[email protected]>
Tableau makes good write blockers for many different types of
connections.=20

-----Original Message-----
From: [email protected] [mailto:[email protected]]
On Behalf Of Matthew Pepe
Sent: Saturday, November 24, 2007 8:24 PM
To: Terry Roebuck
Cc: [email protected]
Subject: Re: Converting an external hard drive enclosure into a write
blocker?

The easiest thing to do is to use a bridge whose firmware can be
modified to take a different action upon the issuance of a write (or
write-related) command.  Operating systems will react differently
depending upon whether the device returns an error code, success code,
or remains quiet.  The bottom line is that you need to intercept
packetized commands - write enable is not based off of a pin pulled high
or low. For more information, check out the ATA/ATAPI5 documents from
the T13 working group.

- Matt


On Nov 20, 2007, at 11:11 AM, Terry Roebuck wrote:

> A*nix mount with DD would be my option of choice, but for windows, I=20
> hesitatingly ask could you not modify an IDE cable to make any=20
> connected drive 'read-only' (might require a resistor - not sure if=20
> you can just clip a wire? - maybe some one with better EE skills could

> answer that?)