Being in the litigation support industry, we work with USB devices almost every day. When working with customer-furnished data, it is very critical to prevent data spoilation by using a write-blocking device. Actions as simple as plugging the hard drive into a computer running Ms Windows and taking a look around are sufficient to alter metadata.
I recommend using OS independent, hardware based write blockers. The brands that I prefer are Tableau and WiebeTech. These products act as a bridge between your computer and the device that you are working with and block write requests at a hardware level while allowing you to read from the device.
Even though these devices are fairly affordable, unfortunately not every litigation support professional has one in his/her arsenal. There are different strategies for those of you who do not have access to such hardware. One of the easiest ways of blocking write requests to USB devices on a Ms Windows computer is by changing the storage device policy in the registry. The following key, starting with Windows XP Service Pack 2, controls whether or not Windows is allowed to write to USB devices:
I made a very small utility yesterday to automate this task and make it a little bit more user friendly. It is called USB Write Protect. All it does is to check whether or not you have a compatible operating system and to allow you to toggle the registry key mentioned above. Please feel free to download it via the link below and let me know if you have any questions or concerns. Please note the following:
- This method blocks write access to USB devices that are connected after the registry key is set. In other words, you need to make sure the device you will be working with is disconnected prior to running USB Write Protect or changing the registry key manually.
- This method only works with Microsoft Windows XP Service Pack 2 and up.
Download USB Write Protect 1.0 [140 KB]
Requires .NET Framework 3.5