Document Type
Article
Publication/Presentation Date
2014
Abstract/Description
"Best practices in digital forensics demand the use of write-blockers when creating forensic images of digital media, and this has been a core tenet of computer forensics training for decades. The practice is so ingrained that the integrity of images created without a write-blocker are immediately suspect. This paper describes a research framework that compares forensic images acquired with and without utilizing write-blockers in order to understand the extent of the differences, if any, in the resultant forensic copies. We specifically address whether differences are superficial or evidentiary, and we discuss the impact of admitting evidence acquired without write blocking. The experiments compare the changes made to a hard drive and flash drive when imaged and examined with a Windows-based forensics workstation."--from the article.
Publication Title
Journal of Digital Forensics, Security and Law
Publisher
Association of Digital Forensics, Security and Law
City
Maidens
Scholarly Commons Citation
Kessler, G. C., & Carlton, G. H. (2014). A Study of Forensic Imaging in the Absence of Write-Blockers. Journal of Digital Forensics, Security and Law, 9(3). Retrieved from https://commons.erau.edu/db-security-studies/28
