jaclaz wrote:
Maybe I am the only one using logic (or my logic is a particular kind of logic <img src="images/smiles/icon_eek.gif" alt="Shocked" title="Shocked" /> ) but till now I had gathered that a Writeblocker was something used to prevent writes (to the evidence disk) IF [u]the whatever tool used attempts to write to it.
If the IXimager (or WinFE for that matters, or any number of forensic oriented Linux distros) does NOT write to the evidence disk, the usage of a Writeblocker is superfluous.I think a writeblocker is something that does prevent writes to anything attached to it (assuming it is working correctly) by anything that might write to it. (new exception with SSDs which can have writes made to them even on a writeblocker) <img src="images/smiles/icon_cry.gif" alt="Crying or Very sad" title="Crying or Very sad" />
jaclaz wrote:
BTW you just wrote how specifically IXmager is intended to be used without a Writeblocker, which should mean that it is "guaranteed" to NOT write anything (to the evidence disk), whilst RyanP just posted that he uses nonetheless a writeblocker in connection with it, even adding how this causes a slowdown of operations as a "side effect".
IXImager can be used with a writeblocker, it's not like it won't work if the evidence drives are behind a writeblocker. It can also be used without a writeblocker and if it is used without a writeblocker there are additional features available.
debbie
↧