Full Windows 10/11 Portable Forensic Boot Environment

Leverage your fully licensed Windows 10/11 operating system to create a portable Windows 10/11 write-protected forensically sound boot environment.

Simple

SAFE Block Win10/11 To Go is the same simple Windows interface that the regular version of SAFE Block uses, allowing the user the ability to block and un-block any disk or flash storage device detected by Windows. Devices are listed in a tree by type (USB, SCSI, IDE) and, where appropriate, by controller and channel.

What are the limitations to SAFE Block To Go?

There are no limitations. SAFE Block To Go provides for a full write-blocked Windows 10 operating system. Whatever you can do with your regular Windows 10/11 forensic workstation, you can do with your new SAFE Block To Go USB drive.

Where can I find information about Windows 10/11 To Go compatible USB drives?

Please visit this page to learn more about Microsoft Windows 10/11 To Go compatible USB drives.

Block Multiple Devices

SAFE Block Win10/11 To Go provides the ability to simultaneously write block as many disk devices as are connected to a computer, without the need for multiple expensive hardware write blocking devices.

Application Independent

SAFE Block Win10/11 To Go is application independent and works with all forensic acquisition and analysis applications that run on Windows 10/11.

How Does SAFE Block To Go Compare with the original SAFE?

When ForensicSoft launched SAFE, the first forensically sound boot disk, it was an outstanding tool for its time. But unlike SAFE Block To Go, the original SAFE product line used a cut-down and time-limited version of Windows called Windows PE. Windows PE was light-weight and had support for many devices drivers. SAFE Block To Go is a fully functional Windows 10/11 environment with access to every Windows 10/11 device driver available in the market. It is literally a Windows 10/11 forensic workstation on a USB drive. Insert the Windows To Go drive into any USB-equipped device, and boot using SAFE Block To Go and all your forensic tools.

How Do I Create My SAFE Block To Go USB Drive?

There are 4 things you'll need: 1) A Windows To Go compatible USB drive*, 2) Install disk or ISO of the Windows 10/11 Operating System version of your choice (Enterprise LTSC recommended), 3) A license to SAFE Block Win10/11 To Go, and 4) The ForensicSoft build scripts provided on the Scripts section of our Support page.

* We recommend a 64GB Windows To Go USB drive or larger to ensure you have room for the OS and all of your standard forensic tools. If creating an x86 and x64 dual-boot WTG USB then we recommend a 128GB USB or larger. While you may build Windows To Go on a non-certified USB, we have seen many non-certified drives overheat during extended operation and are therefore not recommended. We recommend Samsung T7 or Samsung T9 series portable SSD USB drives.

Mount your installation DVD or ISO of the Windows OS you will use to build Windows To Go and extract the install.wim file from the \Sources\ folder of the DVD or ISO to a folder called c:\WTG\ you create in the root of your C:\ drive. Rename the extracted install.wim to Win10EntLTSC2019x64_install.wim as instructed in the readme.txt. If creating a dual-boot WTG USB you will need to repeat this for the x86 install.wim file as instructed in readme.txt. Next, run the appropriate WTG creator Powershell script for either a single or dual boot WTG USB to create your WTG boot disk.

After the Powershell script completes its build process, boot your computer and setup Windows. Install all your favorite Windows forensic tools for triage, acquisition, and analysis. Install SAFE Block Win10/11 To Go and register your SAFE Block WIn10/11 To Go license per the installation instructions in the User Manual. Lastly, once in our running WTG OS, we recommend some final setup steps to maximize the functionality or your WTG OS: 1) run our provided script to disable certain scheduled tasks, 2) set the power/sleep settings to never sleep when plugged in, 3) change the default SAN policy in Diskpart from "Offline Internal" to "Online All", 4) perform all Windows updates and keep WTG up-to-date.

Used Where Hardware Write Blockers Are Not Possible

SAFE Block Win10/11 To Go protects the portable Windows 10/11 To Go Operating System, which is installed on your bootable USB disk. Using your bootable SAFE Block Win10 To Go protected USB disk, you can boot any Intel or AMD based computer and perform data acquisition and/or analysis without the need to remove hard drives. This allows you to forensically image all Microsoft Surface devices, MacBooks, netbooks, and all other laptops where removing the hard drive is difficult if not impossible without breaking the device. Additionally, servers that have multiple hard drives attached to a RAID controller can be imaged as single disks/volumes without the need to remove any hard drives from the server. Unlike, previous Windows PE-based boot disks, there are no OS limitations with a Windows 10 To Go boot disk and drivers are available for just about every device and computer you will come across, including all of the latest SSD technlogies.