SAFE Block is a software-based write blocker that facilitates the quick and safe acquisition and/or analysis of any disk or flash storage media attached directly to your Windows workstation. It is proven to be safe, and significantly faster than hardware write blocking solutions.
Please note: ForensicSoft supports all versions of Windows 10 versions 1709 and earlier.
For all Windows 10 forensic workstations and Windows 10 To Go installations, ForensicSoft highly recommends the clean version of Windows for special purpose (i.e. forensic) computers, called Windows 10 LTSB. If you are unfamiliar with Windows 10 LTSB, you can find more information here.
Are Windows Software Write Blockers Viable?
Many in the industry like the ease of use and lower cost of software write blockers – but are they viable for viewing evidence or making forensically sound copies of disks on Windows systems? Yes! The US National Institute of Standards (NIST) has recently tested a less-functional Windows software write blocker available only to U.S. law enforcement. SAFE Block has also been tested against the NIST test suite and passed all tests. Read more…
SAFE Block Is Faster Than Hardware.
SAFE Block allows for write blocked, Windows-based, disk imaging speeds that are significantly faster than imaging in Windows using commercially available hardware-based write blockers.
SAFE Block Blocks Multiple Devices.
SAFE Block provides the ability to simultaneously write block as many disk devices as are connected to a computer without the need for multiple eensive hardware write blocking devices.
SAFE Block Is Application Independent.
SAFE Block is application independent and works with all forensic acquisition and analysis applications that run on Windows.
SAFE Block Supports HPA and DCO Unlocking.
SAFE Block identifies and provides access to Host Protected Areas (HPAs) and Device Configuration Overlay (DCOs) on IDE (PATA and SATA) disks, connected directly via PATA or SATA controllers. HPAs are temporarily removed and make no permanent modification to the disk configuration, using volatile HPA commands. Since a DCO cannot be removed temporarily, SAFE Block preserves all DCO information, allowing safe removal of the DCO or HPA/DCO combination, then upon completion of the acquisition, replacement of the DCO or HPA/DCO combination back to its original state. *Not yet available on SAFE Block Vista or Windows 7.
SAFE Block Does Automatic Write Blocking.
SAFE Block provides automatic write blocking of all directly attached media, including IDE (PATA & SATA), SCSI, FC, SAS, USB, USB-C (Thunderbolt-3) and IEEE1394. The user controls automatic write blocking policies for fixed and/or removable disks. The user can have SAFE Block remember each fixed device’s blocked or un-blocked status for ease of use on media repeatedly used on a workstation/laptop.
SAFE Block Is Simple.
SAFE Block is a simple Windows GUI interface that allows the user the ability to block and un-block any disk or flash storage device detected by Windows. Devices are listed in a tree by type (USB, SCSI, IDE) and, where appropriate, by controller and channel.