|
|||||
Hard Drive Write Blocking |
|||||
Computer Forensic Devices |
|
|
|
||
How It Works CoreSHIELD™ functions as a low-level data controller. CoreSHIELD™ controls all the data between the drive and the motherboard. It blocks write instructions to the protected drive at the ATA command interface level. This blocking occurs at the lowest level signal interface, prior to recognition by the computer’s operating system (OS), even before the initial hardware polling by the BIOS. The CoreSHIELD™ bridge card contains a specially designed central processing unit ASIC microchip, RAM and hard-coded logic to absolutely prevent any writes to the protected drive. The protected drive will be shown as a “CoreSHIELD™” device in the BIOS and hardware management utilities, rather than the normal drive manufacturer’s information. If you see CoreSHIELD™ being displayed in the BIOS, during the boot process or when the drives are queried for identification at a physical level, you have a functioning protected assembly and can be assured that absolutely no data on the protected drive will be changed. While all
deliberate or incidental attempts to write to the blocked drive are
effectively blocked by CoreSHIELD™, it may appear to the user
that writes are actually being made to the protected drive. This is
due to the operating system’s use of memory caching schemes.
Caching may allow what appear to be writes or data changes to be displayed,
particularly when viewed in the file manager utility. However, these
are only virtual changes. You can be assured that CoreSHIELD™ is
protecting the drive and not allowing any actual changes. Any apparent
changes that are displayed are actually held in the volatile cache
memory and will be cleared upon powering down or rebooting the computer.
Unmounting and remounting of the drive, on operating systems such as
Apple’s, which easily allow for such operations, will also clear
the cache. |
|||
| ©2003 Computer Forensic Solutions LLC. Home • Contact | Home • Products • Support • Services • Contact |