Imaging Using Write Blocker | FTK Imager + Write Blocker Step By Step Process
Here we have used CRU write blocker with FTK Imager. Watch the full video to understand the step by step process.
What are write blockers?
1. A write blocker is a tool that prevents or ‘blocks’ any modifying command operations from ever reaching the storage device.
2. It permits read-only access to storage devices ensuring that the integrity of the device is not compromised.
Imaging using write blocker
Imaging storage devices using write blockers ensures that the data is not altered in any way during the process.
We will now demonstrate, how to image a storage device using a write blocker
Steps:
1. Activate the writing block device.
2. Connect the drive to the write blocker.
3. As the drive opens, I will now make changes. Let’s create a few test folders and files.
4. To make sure the changes has been made, I will access the drive again. Until now it seems like the changes has been made.
5. Now, I will connect the drive again, to confirm if the changes were made permanently.
6. No, there are no test files or folders or any changes that we made earlier, when the drive was connected through a write blocker.
7. To image this drive, I will be using FTK imager.
8. Click on “Create Disk Image”.
9. Select “Physical Drive”. Click on “Next”. From the drop-down menu, find your storage drive and select it.
10. Click on “Finish”. Click on “Add”, We get a list of Image formats, I will select “E01”. Click on “Next”.
11. To give the “Image Destination Folder”, click on Browse, select the path.
12. Let’s name this image as Test. Click on “Finish”.
13. Click on Start.
The process of imaging starts.
The write blocker will not allow any write operations on the attached files like creation of file, modifications to file, or even deletion of data from file.
It therefore maintains the evidence integrity and prevents the system from being compromised.
A write blocker, when used properly, can guarantee the protection of the data chain of custody
There are two types of write blockers, Hardware & software.
Download the FREE Write Blocker software: [ Ссылка ]
#writeblocker #forensics #ftkimager
