Forensic disk controller

Lore & Background

Historically, forensic disk controllers were made in the form of a dongle that fit between a computer and an IDE or SCSI hard drive. With the advent of USB and SATA, controllers supporting these newer technologies became widespread. The device intercepts write commands from the host operating system, preventing them from reaching the drive. When the host bus architecture supports it, the controller reports that the drive is read-only. The controller can either deny all writes and report them as failures, or use on-board memory to cache writes for the duration of the session. A controller that caches writes presents the appearance that the drive is writable, retrieving sectors from the disk if unchanged and from memory for changed sectors.

Reader's Guide

Forensic disk controllers are most commonly associated with creating a disk image, or acquisition, during forensic analysis, preventing inadvertent modification of evidence. Using hardware to protect the hard drive from writes is important because many operating systems, including Windows, may write to any connected hard disk—updating access times, creating hidden folders, or committing NTFS transactions. Virus infections or malware on the analysis system may attempt to infect the inspected disk. Protecting an evidence drive from writes also counters potential allegations that the drive's contents were altered during investigation; without such technology, there is no way to refute such allegations.

Did You Know?

• Steve Bress and Mark Menz invented hard drive write blocking (US Patent 6,813,682).
• A device installed between storage media and an investigator's computer is called a 'bridge kit'.
• The United States National Institute of Justice operates a Computer Forensics Tool Testing (CFTT) program for forensic disk controllers.
• A forensic disk controller can either deny all writes or cache writes in on-board memory to simulate a writable drive.