Skip to content

00.Software Write Blocker Concept

🔹 What is a Write Blocker?

It’s a tool—either hardware-based or software-based—that prevents any attempt to add, modify, or delete data on a disk or device during forensic analysis.\ In this guide, we focus on the software version.

🔧 Tools Used:

  • Software Write Blocker from: forensicsoft.com/products/safeblock

  • The program is available with a 7-day trial.

  • Some Linux forensic distributions, like SIFT, come with a built-in software write blocker.

⚙️ Steps to Use the Write Blocker Program:

  1. Download and Install:

  2. Register on the website and download the software.

  3. You’ll be asked for a license file during installation.

  4. Set a password to protect the program from unauthorized use.

  5. Launch the Program:

  6. Upon launch, you’ll be prompted for the password.

  7. The interface will show:

    • Physical disks

    • Logical partitions (like C:\ or G:)

  8. Select Target Disk:

  9. You cannot apply blocking to the system partition (like C:).

  10. Choose another drive (e.g., G:) for testing.

🧪 Practical Test:

Before Activation:

  • You can copy or delete files freely from the G:\ drive.

  • You can read/write as you like.

After Activation (Enable Blocking):

  • The program may close File Explorer if it's using the disk.

  • A 🔒 icon appears next to the drive name → indicating "write protection" is active.

Test:

  • Try copying a file: ❌ Not allowed

  • Try deleting a file: ❌ Not allowed

✅ Result: The disk is now completely write-protected.

✅ Why Use a Write Blocker?

Benefit Explanation
🧩 Evidence Protection No modifications are allowed during analysis.
🦠 Malware Defense Even if malware is present, it can't alter data.
🔒 Data Integrity Evidence remains exactly as it was when seized.
📸 Forensic Imaging Images created from the disk are legally trustworthy.

📌 Important Note:

Software Write Blockers are not recommended for critical cases since they are not as secure as hardware write blockers.\ However, they are useful for training or low-risk scenarios.

🧭 Summary:

Item Details
Tool Used Software Write Blocker from ForensicSoft
Purpose Prevent disk modification during examination
State After Activation No copying, deleting, or editing files allowed
Ideal Use Case Creating a forensic image or analyzing a suspect’s drive