Ride the Lightning

FOR THE PROPELLER HEADS: SENSEI’S SAFE BLOCK XP TESTING

August 4, 2008

We recently completed basic testing on ForensicSoft’s “SAFE Block XP” version 1.1, a software-based write-blocker designed for the Windows XP Operating System. The SAFE Block XP software allows for the read-only acquisition and/or analysis of any storage device attached directly to the workstation, regardless of interface or connection type. The vendor’s website provides a detailed user’s guide documenting the installation, setup and usage of the software, as well as The University of Rhode Island Digital Forensics Center’s evaluation of SAFE Block using the National Institute of Standards and Technology’s (NIST) guidelines for testing software write-blockers.

In testing the software, we conducted three, simple, hard-disk drive imaging comparisons using a stand-alone hardware imager, a hardware write-blocker and SAFE Block XP. All three test scenarios completed without error and resulted in the creation of a unaltered, bit-for-bit forensic image file. SAFE Block XP performed as expected, providing a level of read-write controllability not available by the other methods.

At $219.00, with volume discounts available, SAFE Block XP is a budget-friendly alternative to the current write-blocking methods available. It provides enhanced, read/write management of as many storage devices as one can connect to their workstation. We are very pleased to have this tool as part of our arsenal. The company’s website may be found at http://www.forensicsoft.com/catalog/index.php

Thanks to Dan Fuller and Jesse Lindmar for their testing and documentation!

E-mail:     Phone: 703-359-0700