Computer Forensics Expert Note: A computer forensics examiner or computer forensics expert, particularly in States such as Virginia, where courts are very strict about the required procedures to be followed by a Virginia computer forensics expert, must be comfortable with the use of write blocking devices. The non-use or improper use of these may cause the digital evidence to not be admissible.
In order to test a write blocking device, it is suggested to:
1. Wipe a hard drive with 0×00 and verify the wipe with the dcfldd pattern=00 vf=/dev/hd#;
3. Install an operating system on the wiped drive;
4. Hash the wiped drive;
5. Connect the wiped drive to the write blocking device;
6. Try to save a file to the write blocked drive and make sure that the write failed, if so, a second hash value of the drive should match the value obtained from step 4.
This computer forensics information is presented by AVM Technology, LLC, a Computer Forensics, E-Discovery, and Computer Security consulting company located in Richmond, VA and serving clients throughout the United States.