Forensic Images using DDP?

[acrosstech]

Hi folks,
  Can we use this system to create Forensically Safe images?
We have been looking at Write Blockers but then I thought
that this brilliant piece of technology might be able to do
what we need.
  If not at this point could you, Stanley, apply a switch to
disable all writes to the drive?
  Forensic images must not change the original drive in any
way.
  FYI we have been looking at Forensic UltraDock 5.5
This meets the strict requirements for forensic analysis.

https://www.cru-inc.com/products/wiebete...v5-5/#info

[DRA]

Hi folks,
  Can we use this system to create Forensically Safe images?
We have been looking at Write Blockers but then I thought
that this brilliant piece of technology might be able to do
what we need.
  If not at this point could you, Stanley, apply a switch to
disable all writes to the drive?
  Forensic images must not change the original drive in any
way.
  FYI we have been looking at Forensic UltraDock 5.5
This meets the strict requirements for forensic analysis.

https://www.cru-inc.com/products/wiebete...v5-5/#info

It shouldn't be too difficult to tell if it is forensically sound. Maybe try calculating a hash on the source pre and post image acquisition to see if there is any change. DDP does have a write-blocking checkbox from memory. I would enable this and see.

[acrosstech]

Thank you.
I will see about the write blocking checkbox.
Obviously I missed it!

regards
Tony

[Dolphin999]

Hello Tony, after you tick the write blocking, it is fully read-only and won't do any write operations on the patient. The only missing part for forensic image is the real-time checking.

[DRA]

Hello Tony, after you tick the write blocking, it is fully read-only and won't do any write operations on the patient. The only missing part for forensic image is the real-time checking.

Might pay to check the SMART on the drive before and after acquiring the image just to see if anything important changed during the acquisition i.e. if the drive condition degrades during the process.

Dolphin, does DDP have hashing capability for forensic images?

[Dolphin999]

Hash capabilities will be added to forensic addon. Smart parameters keep changing, the most important is hash checking, real-time checking for forensic image.