Tableau makes good write blockers for many different types of
connections.

-----Original Message-----
From: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]]
On Behalf Of Matthew Pepe
Sent: Saturday, November 24, 2007 8:24 PM
To: Terry Roebuck
Cc: forensics (at) securityfocus (dot) com [email concealed]
Subject: Re: Converting an external hard drive enclosure into a write
blocker?

The easiest thing to do is to use a bridge whose firmware can be
modified to take a different action upon the issuance of a write (or
write-related) command. Operating systems will react differently
depending upon whether the device returns an error code, success code,
or remains quiet. The bottom line is that you need to intercept
packetized commands - write enable is not based off of a pin pulled high
or low. For more information, check out the ATA/ATAPI5 documents from
the T13 working group.

- Matt

On Nov 20, 2007, at 11:11 AM, Terry Roebuck wrote:

> A*nix mount with DD would be my option of choice, but for windows, I
> hesitatingly ask could you not modify an IDE cable to make any
> connected drive 'read-only' (might require a resistor - not sure if
> you can just clip a wire? - maybe some one with better EE skills could

> answer that?)

[ reply ]