SAFE Block To Go

SAFE Block To Go creates the next generation forensically sound Windows boot disk. It provides you the absolute best forensic control boot disk in the world, far surpassing the capabilities of any Linux or Windows PE forensic boot disk. SAFE Block Win10 To Go is a software-based write blocker designed for the portable Windows 10 To Go Operating System and will not run on versions of Windows other than Windows 10 To Go. SAFE Block Win10 To Go provides for the quick and safe acquisition and/or analysis of any disk or flash storage media installed in or attached directly to any computer you boot with your Windows 10 To Go bootable USB disk.

Unlike all other forensic boot disks, SAFE Block To Go gives you a full portable Windows 10 forensic workstation on a USB drive. SAFE Block To Go adds the industry-recognized software write blocking of SAFE Block to your certified Windows 10 To Go USB disk. You can now boot and safely acquire and/or analyze any Intel/AMD-based device using your SAFE Block To Go drive. This is ideal for devices with drives that are hard (or impossible to remove) such as tablets and notebooks, including write-blocking and imaging of NVMe SSD hard drives. And you can now easily and safely image every RAID, SAS, Fiber Channel and/or laptop hard drive without the need for special adapters, controller cards, or any other hardware device not already present on the machine. In addition, even those drives protected by BitLocker can be accessed and analyzed. Read more…

Please note: ForensicSoft highly recommends the clean version of Windows for special purpose (i.e. forensic) computers, called Windows 10 LTSC. If you are unfamiliar with Windows 10 LTSC, you can find more information here . Most of our larger customers use LTSC exclusively for their forensic machines. If you do not have access to LTSC, we fully support all versions of Windows 10 versions through the current 1909 for Windows To Go.

ForensicSoft and the top manufacturer of Microsoft certified WTG USBs, Spyrus, both commit to fully supporting WTG for the next decade. See the linked article for more information.

See our Support Page for our free PowerShell scripts for creating standard or dual-boot (x64/x86) WTG Forensic Boot Disks. Also available is a script to further improve your WTG OS by disabling unwanted scheduled tasks.

SAFE Block To Go Features

Full Windows 10 Portable Forensic Boot Environment

Leverage your fully licensed Windows 10 operating system to create a portable Windows 10 write-protected forensically sound boot environment.

Simple

SAFE Block Win10 To Go is the same simple Windows interface that the regular version of SAFE Block uses, allowing the user the ability to block and un-block any disk or flash storage device detected by Windows. Devices are listed in a tree by type (USB, SCSI, IDE) and, where appropriate, by controller and channel.

What are the limitations to SAFE Block To Go?

There are no limitations. SAFE Block To Go provides for a full write-blocked Windows 10 operating system. Whatever you can do with your regular Windows 10 forensic workstation, you can do with your new SAFE Block To Go USB drive.

Where can I find information about Windows 10 To Go compatible USB drives?

Please visit this page to learn more about Microsoft Windows 10 To Go compatible USB drives.

Block Multiple Devices

SAFE Block Win10 To Go provides the ability to simultaneously write block as many disk devices as are connected to a computer, without the need for multiple expensive hardware write blocking devices.

Application Independent

SAFE Block Win10 To Go is application independent and works with all forensic acquisition and analysis applications that run on Windows 10.

How Does SAFE Block To Go Compare with the original SAFE?

When ForensicSoft launched SAFE, the first forensically sound boot disk, it was an outstanding tool for its time. But unlike SAFE Block To Go, the original SAFE product line used a cut-down and time-limited version of Windows called Windows PE. Windows PE was light-weight and had support for many devices drivers. SAFE Block To Go is a fully functional Windows 10 environment with access to every Window 10 device driver available in the market. It is literally a Windows 10 forensic workstation on a USB drive. Insert the Windows To Go drive into any USB-equipped device, and boot using SAFE Block To Go and all your forensic tools.

How Do I Create My SAFE Block To Go USB Drive?

There are 4 things you’ll need: 1) A Windows To Go compatible USB drive*, 2) Install disk or ISO of the Windows 10 Operating System version of your choice (Enterprise LTSC recommended), 3) A license to SAFE Block Win10 To Go, and 4) The ForensicSoft build scripts provided on the Scripts section of our Support page.

* We recommend a 64GB Windows To Go USB drive or larger to ensure you have room for the OS and all of your standard forensic tools. If creating an x86 and x64 dual-boot WTG USB then we recommend a 128GB USB or larger. While you may build Windows To Go on a non-certified USB, we have seen many non-certified drives overheat during extended operation and are therefore not recommended. Most of our customers use either Spyrus or SuperTalent WTG certified USB drives.

Mount your installation DVD or ISO of the Windows OS you will use to build Windows To Go and extract the install.wim file from the \Sources\ folder of the DVD or ISO to a folder called c:\WTG\ you create in the root of your C:\ drive. Rename the extracted install.wim to Win10EntLTSC2019x64_install.wim as instructed in the readme.txt. If creating a dual-boot WTG USB you will need to repeat this for the x86 install.wim file as instructed in readme.txt. Next, run the appropriate WTG creator Powershell script for either a single or dual boot WTG USB to create your WTG boot disk.

After the Powershell script completes its build process, boot your computer and setup Windows. Install all your favorite Windows forensic tools for triage, acquisition, and analysis. Install SAFE Block Win10 To Go and register your SAFE Block WIn10 To Go license per the installation instructions in the User Manual. Lastly, once in our running WTG OS, we recommend some final setup steps to maximize the functionality or your WTG OS: 1) run our provided script to disable certain scheduled tasks, 2) set the power/sleep settings to never sleep when plugged in, 3) change the default SAN policy in Diskpart from “Offline Internal” to “Online All”, 4) perform all Windows updates and keep WTG up-to-date.

Used Where Hardware Write Blockers Are Not Possible

SAFE Block Win10 To Go protects the portable Windows 10 To Go Operating System, which is installed on your bootable USB disk. Using your bootable SAFE Block Win10 To Go protected USB disk, you can boot any Intel or AMD based computer and perform data acquisition and/or analysis without the need to remove hard drives. This allows you to forensically image all Microsoft Surface devices, MacBooks, netbooks, and all other laptops where removing the hard drive is difficult if not impossible without breaking the device. Additionally, servers that have multiple hard drives attached to a RAID controller can be imaged as single disks/volumes without the need to remove any hard drives from the server. Unlike, previous Windows PE-based boot disks, there are no OS limitations with a Windows 10 To Go boot disk and drivers are available for just about every device and computer you will come across, including all of the latest SSD technlogies.

SAFE Block To Go License Attributes

• Single-instance use, licensed is machined-tied to the USB drive on which it is installed
• Volume licenses available by contacting sales@forensicsoft.com
• For support and other technical questions please contact support@forensicsoft.com