Write Blocker - BenWare-FED/Notes-for-df-analysis GitHub Wiki

-Just by connecting a drive to a system, meta will be altered and the evidence will become invalid.

-there are both hardware and software write-blockers.

-Hardware write-blockers are preferred to software write-blockers

Software write blockers can be compromised by human error and threat actors.

Some drives have advanced drive formats that have sectors of 4,096.

Systems always read all 512 bytes. If only 10 bytes are actual data, the other 502 bytes will be filled with zeros.