The Problem

If you have electronic evidence (thumb drive, USB hard drive, etc), the last thing you want to do is alter the evidence, right?  If you remove files, add files or alter files then the evidence would no longer be terribly accurate.

The Solution

To prevent altering data, you should connect electronic evidence to your computer using a write blocker.  This is typically a piece of hardware that sits between your computer and an external USB hard drive that makes it impossible to write data to the external drive.

WiebeTech now offers and affordable write blocker that is the size of a regular thumb drive.  It is definitely worth checking out, especially for the price.

But what do you do if you do not have a write blocker handy?  Do you just plug-in the evidence and risk altering data?  Well, you don’t need to take that risk, thanks for some good information from a trusted litigation support guru, Kel Rollins.  Apparently there is a Windows registry key you can add that will prevent all writes to removable media:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies]
“WriteProtect”=dword:00000001

Now that is what I call a simple write blocker!  Thanks for the tip, Kel.