Test Results for Hardware Write Block Device: WiebeTech Forensic SATADock (USB Interface)

• NCJ Number: 216299
• Date Published: December 2006
• Length: 18 pages
• Grant Number(s): 2003-IJ-R-029
• Agencies: NIJ
• Publication Type: Test/Measurement

Annotation

This report presents the results from testing the WiebeTech Forensic SATADock write blocker against the Hardware Write Blocker (HWB) Assertions and Test Plan Version 1.0.

Abstract

All four specifications outlined for the WiebeTech Forensic SATADock write blocker were met in the testing. Four main requirements were specified for the WiebeTech Forensic SATADock write blocker: (1) the device should not transmit a command to a protected storage device that modifies the data on the storage device; (2) the device should return the data requested by a read operation; (3) the device should return without modification any access-significant information requested from the drive; and (4) any error condition reported by the storage device to the HWB device should be reported to the host. Test results are presented according to these four specifications. Results indicated that the WiebeTech Forensic SATADock write blocker always blocked commands that would have changed user or operating system data stored on a protected drive. The device also always allowed commands to read the protected drive and always returned access-significant information from the protected drive without modification. Finally, results revealed that the device always returned error codes from the protected drive without modification. All tests were run in the National Institute of Standards and Technology’s (NIST’s) Computer Forensics Tool Testing (CFTT) laboratory using one test computer named “Freddy.” A Data Transit bus protocol analyzer was used to monitor and record commands sent from the host to the write blocker device. The hard disk drives and the support software used in the testing are described. Tables