 Hello, everyone. Today, we're going to be talking about write blockers. And this week, we were talking about acquisition and acquiring data. And one of the things we have to do is make sure we do not modify the suspect disk. We do not want to change anything on the original suspect disk. So we have here an external write blocker, and this is a Tableau forensic write blocker. And I can see on the left hand side here, I can, this is the side that I connect to my forensic workstation or the computer that I have. And I see that it supports different versions of Firewire USB 2.0, which I know is going to be relatively slow. And then also eSATA. So here, eSATA is probably going to be one of the faster connections. So I'm probably going to want to use the eSATA connection to connect to my forensic workstation, if I can. So just the connectors on the side here, we see different types of Firewire. This is the connector for power coming into the write blocking device, because it has to have power to work. So we have power coming into the write blocking device. And then we choose one of these connectors that we want to connect back to our forensic workstation. It can be USB, but that will be relatively slow Firewire, which some computers don't support anymore. And then I have eSATA. And like I said, that's probably going to be one of the faster ways to connect. So I can see whenever I actually plug this in, I have a couple different identifiers here. We have a power button to actually turn the device on. So does the device have power? Can we detect the device, the actual suspect device that we're connecting to it? Can we detect the host that we're connecting to? Is write blocking actually enabled, right? And is there activity going on? So is there any connectivity or activity from the host to the device? And I haven't shown you yet, but on this side, we have connectors for the actual device. So the suspect device will go on this side. And this is a connector for SATA. So this supports SATA connectors. And this is actually the power for the SATA connector. And here I have one of the connectors for SATA or a SATA disk. So I can see that this would be like an internal SATA disk. And these are the connectors that this is for power. And this is for the actual data transmission. So I can connect the SATA connector to the right blocker like this. Okay. So now I have basically coming in a SATA connector that would connect to, for example, a hard drive. And I have a SATA connector going through, connecting to the right blocker, and then connecting out to my forensic workstation. And the idea is that my forensic workstation should be able to connect to this, see the hard drive, like a normal hard drive, but not be able to write anything to the hard drive. It can only read from the hard drive and not write back to it. So here I have a hard drive. And this is a SATA hard drive. So it should be internal. It's an internal hard drive. And I can tell it's SATA because of this connector. This is basically the point for data. This is the point for power. So this is basically a normal internal SATA hard drive. This is a hard disk drive, not a solid state disk. And again, whenever we're dealing with hard drives, we never want to touch the circuitry. Do not put your hands directly on anything green. You see I'm holding everything basically from the sides. The sides are usually the point where you want to hold these devices. So I can see that it's SATA. So we have our right blocker here. And I have my SATA connector already plugged in or connected up. So I want to connect my hard drive. Hope this gets on camera. I want to connect my hard drive basically like this. And now we have, if you can see it, we have our hard drive, our suspect hard drive. It will receive power and transmit data to our right blocker. Our right blocker will be connected back to our forensic workstation. And this device will prevent us writing or changing any data on the hard disk. So what we're able to do now is acquire all of the data from this hard disk without having to worry about any changes to the hard disk. Now, you did see before there are some a few indicator lights, for example, power device detect host detect right block. We definitely want to make sure whenever we plug the right blocker in to begin with that host detect is is lit up. And I usually what you what you should do is have a test hard drive that you can connect up and make sure that right block is actually enabled, make sure that the right block light is on, make sure the device detect light is on with your test hard drive first, you do not want to use the suspect hard drive. To begin with, you want to use your test hard drive first. Once you know that your right blockers working okay, then you can connect every you can disconnect and connect back up the suspect hit disk and start working with the suspect disk. Okay, so this is my SATA my SATA right blocker. I also have another right blocker here Tableau makes quite a few different types and basically we have the same lights or indicator lights again this one also has a menu for a couple different things we have power over here. And on one side we have USB. On the other side we have USB. So in this case this is a USB right blocker because a lot of disks we get might be USB hard drives. So in this is basically the same concept we have this right blocker. We would put the device and this is USB 3.0 so we know it's going to be relatively quick we have the device on this side and we can just plug in the suspect device. In this case the USB stick and then out on the other side this connects back to our host our host computer. Now in this case because I'm dealing with a flash disk this is a USB stick so usually or flash. The right blocker will block my forensic workstation from writing any changes to this disk. However this has a controller inside of it and some changes are possible because of the way that flash memory works. So we have to be careful about that if we for example get a different hash value after we acquire this disk image it could be because of the internal workings of the flash drive or it could be because our right blocker was done in an inappropriate or incorrectly or maybe it's bad or something. So definitely make sure before you actually use suspect disks with your right blockers you always test the disk to make sure that it is working as you expect it to work. And then also think about the media you're using if you're using something like flash. Well how does flash storage work how does hard disk drives work and what are the chances of the data changing based on something either you've done or the way that they just work normally. So that's it for external right blockers. Next we'll talk about how to acquire data from these disks directly.