SAFE Block 1.0

SAFE Block is a software-based write blocker computer forensics tool for the Windows 2000/XP Operating Systems. SAFE Block facilitates the quick and safe acquisition and/or analysis of evidence on any disk or flash storage media attached directly to your forensic workstation. It has a simple Windows GUI interface that allows the user the ability to block and un-block any disk or flash storage device detected by Windows. Devices are listed in a tree by type (USB, SCSI, IDE) and, where appropriate, by controller and channel. SAFE Block provides the ability to simultaneously write block as many disk devices as are connected to a computer without the need for multiple expensive hardware write blocking devices. SAFE Block is application independent and works with all forensic acquisition and analysis applications that run on Windows 2000/XP. SAFE Block allows for write blocked, Windows-based, disk imaging speeds that are significantly faster than imaging in Windows using commercially available hardware-based write blockers. SAFE Block identifies and provides access to Host Protected Areas (HPAs) and Device Configuration Overlay (DCOs) on IDE (PATA and SATA) disks, connected directly via PATA or SATA controllers. HPAs are temporarily removed and make no permanent modification to the disk configuration, using volatile HPA commands. Since a DCO cannot be removed temporarily, SAFE Block preserves all DCO information, allowing safe removal of the DCO or HPA/DCO combination, then upon completion of the acquisition, replacement of the DCO or HPA/DCO combination back to its original state. SAFE Block provides automatic write blocking of all directly attached media, including IDE, SCSI, USB, and IEEE 1394. The user controls automatic write blocking policies for fixed and/or removable disks. The user can have SAFE Block remember each device's blocked or un-blocked status for ease of use on media repeatedly used on a workstation/laptop.