UltraBlock Switches

Written By:
Dave Kelsey
Last Edited:

Can't you ship forensic bridges that work in all situations without configuration switches?

Each Microsoft OS prior to Windows XP has its own peculiar problems in working with forensic bridges. Designing a bridge to the "lowest common denominator" of the Windows OS's itself leads to some undesirable compromises.

For example, one of the ways to make older Windows operating systems work "correctly" with forensic read-only bridges is to make the OS "think" that the bridge/hard disk is really read-write. In this mode, the bridge simply "throws away" any writes sent by the computer to the hard disk. But, this can lead to problems, as Windows maintains an in-memory cache of what it "thinks" is on the hard disk. When a bridge throws away write data, but makes the computer think the write succeeded, Windows gets out of sync with what's really on the disk; and this can lead to errors in capturing forensically sound images from a subject drive.

When necessary, i.e., when using an older Windows OS, the UltraBlocks can be configured to trick Windows as just described. But, if you are using a version of Windows like Windows XP - which handles read-only bridges correctly - you are far better off if the bridge tells Windows that it is read-only. In this way, you can guarantee that Windows XP is in sync with the data that is really on the disk, and you can guarantee the forensic validity of images captured from the subject hard disk.

Still Need Help?