SAFE Block User's Guide

What is SAFE Block XP?

SAFE Block XP is a software-based write blocker designed for the Windows XP Operating Systems. SAFE Block XP will not run on Vista. SAFE Block XP provides for the quick and safe acquisition and/or analysis of any disk or flash storage media attached directly to your forensic workstation.

• Simple. SAFE Block XP is a simple Windows GUI interface that allows the user the ability to block and un-block any disk or flash storage device detected by Windows. Devices are listed in a tree by type (USB, SCSI, IDE) and, where appropriate, by controller and channel.
  
  
• Block Multiple Devices. SAFE Block XP provides the ability to simultaneously write block as many disk devices as are connected to a computer without the need for multiple expensive hardware write blocking devices.
  
  
• Application Independent. SAFE Block XP is application independent and works with all forensic acquisition and analysis applications that run on Windows XP.
  
  
• Faster Than Hardware. SAFE Block XP allows for write blocked, Windows-based, disk imaging speeds that are up to 10 times faster than imaging in Windows using commercially available hardware-based write blockers.
  
  
• HPA and DCO Support. SAFE Block XP identifies and provides access to Host Protected Areas (HPAs) and Device Configuration Overlay (DCOs) on IDE (PATA and SATA) disks, connected directly via PATA or SATA controllers. HPAs are temporarily removed and make no permanent modification to the disk configuration, using volatile HPA commands. Since a DCO cannot be removed temporarily, SAFE Block XP preserves all DCO information, allowing safe removal of the DCO or HPA/DCO combination, then upon completion of the acquisition, replacement of the DCO or HPA/DCO combination back to its original state.
  
  
• Automatic Write Blocking. SAFE Block XP provides automatic write blocking of all directly attached media, including IDE, SCSI, USB, and IEEE 1394. The user controls automatic write blocking policies for fixed and/or removable disks. The user can have SAFE Block XP remember each fixed device's blocked or un-blocked status for ease of use on media repeatedly used on a workstation.