Hardware write blockers are key pieces of equipment for any forensic examiner when acquiring a forensic clone of any data. This is true for analysis of memory cards and USB devices as well.
CRU Inc. offers another hardware write blocker to assist in the acquisition of data from memory cards and USB devices known as the WiebeTech Media WriteBlocker. Continue reading
I am currently running my forensic workstation as a virtual machine within VMware Workstation 12.5. I chose to do this for multiple reasons, some of which include snapshots to roll back the workstation, ability to test different forensic tools, test OSs for the workstation (Windows vs Linux), etc. Not to mention the cost associated with VMWare Workstation compared to having several machines running different OSs as well as the portability of it all
So far this setup has worked well as test bed for the start of my expedition. There have been a few performance hurdles but nothing that a little patience wouldn’t take care of. However today I ran into an issue that, although I was able to overcome is disappointing to say the least. Continue reading