What to Look For in a Write Blocker
One of the essential tools you’ll need when recovering video evidence from surveillance DVRs is a write blocker. Write blockers are devices that allow you to read the information on the drive without the possibility of accidentally altering or writing to the drive contents. When using DVR Examiner, we always ask you to connect the DVR to your computer in a write-protected manner.
When purchasing a write blocker, the required features depend on your specific needs. However, there are some general points to keep in mind that we recommend to customers.
First, we recommend hardware over software for write blocking. This recommendation is primarily because hardware write blockers operate independently from your computer system. Software write blocking tools can be affected by OS updates and many other variables. Also, an external write blocker has more visual indicators to verify that the computer is not writing to the drive. Many external write blockers have red/green indicator lights and a text screen to verify that your data is protected.
The CRU® WiebeTech® Forensic ComboDock™ is an easy-to-use, professional-grade, dual (read-only and read/write) dock that provides a plethora of host and drive connections.
Second, note the connection types available on any write blockers you may purchase. Does the write blocker support both IDE and SATA source drive types? What are the output connection options? If there is a USB 3.0 option is there also the option for it to use USB 2.0 in case your computer does not have USB 3.0? SATA to SATA swill provide the fastest imaging/data transfer speeds; however, USB 3.0 is the most commonly available for many workstations.
The CRU® WiebeTech® Forensic UltraDock™ is an easy-to-use, professional-grade, forensic write-blocker with SATA and USB2/3 host connections.
Third, will you ever need to make writes to the external drives you are connecting? Some write blockers allow you to switch between read-only and read/write modes. If you ever need to connect a SATA/IDE drive to your work station to write to a drive, you may want to consider getting a write blocker that supports both read-only and read/write for the sake of convenience.
The CRU® WiebeTech® Drive eRazer™ Ultra is a stand-alone device that completely and quickly cleans hard drives.
Finally, make sure the write blocker is compatible with Advanced Format drives. Due to the need for increased drive sizes, hard drives have transitioned to a sector size of 4096. Make sure your chosen write blocker supports the most common Advanced Format type of 512e (emulated 512 byte).