Hardware Write Blockers

Operating systems write to a drive the moment it is connected. Windows updates timestamps, creates system folders and may try to repair a file system it thinks is damaged. A hardware write blocker, also called a forensic bridge, is a small device that passes read commands through and blocks every write, so the drive can be examined and imaged without a single sector changing. The best known product line is the OpenText Forensic Bridges family, sold under the Tableau name for many years. Its data sheet lists portable units for SATA and IDE, SAS, PCIe and USB drives, and drive bay units such as the T356789iu Universal Bridge for the laboratory bench. Other makers sell similar devices and most professional imagers, such as the OpenText Forensic TX2 Imager and the Logicube Falcon-NEO2, have write-blocked source ports built in.

The device is simple to use but still needs care. The examiner checks the write-block indicator before connecting the drive, confirms the DIP switch or mode setting if the unit can be switched to read and write, and records the model, serial number and firmware version in the case notes. A laboratory should validate each blocker by trying to write to a test drive through it and hashing the drive before and after. Some drives also carry a host protected area or device configuration overlay, which a blocker will reveal but not remove, so the imaging tool must be told how to handle them.