One of the problems facing IT workers in digital forensics is securely gathering data from modern hard drives—unlike floppy disks and SD cards, there is no jumper to set on modern hard drives that prevents writes from being committed to the drive.

When working with drives pulled from computers seized for evidence, plugging those drives into a second computer for analysis can result in unintended consequences, as Windows will change the access time on files that are accessed, and may (over)write temporary files on the mounted volume, potentially destroying previously deleted files that may serve as evidence.

SEE: Quick Glossary: Solid State Drives (TechRepublic Premium)

To overcome this potential risk, forensic disk controllers are able to mount drives as read-only, preventing the potential for overwritten files as a result of background processes on Windows. Use of forensic disk controllers also provides a defense against the potential of allegations that drive contents were altered during investigation.

ICS-JMR DriveLock: USB-C to SATA

The newest version of the DriveLock is a USB-C to SATA model, eliminating the need for the relatively unsightly, and not altogether common USB 3.0 micro-A connector commonly found in mainstream USB to SATA drive converters. There’s no enclosure to lock the drive in, which generally makes it easier to use, though users will need a flat surface to work on to avoid disconnecting the drive while in operation.

Electrically, the DriveLock is not altogether dissimilar to standard USB to SATA drive converters—an SSD or 2.5″ HDD can be powered via USB, while a 3.5″ HDD requires an (included) 12v AC adapter. Status LEDs indicate if power is being delivered, as well as drive activity and presence of the USB connection.

It’s also possible to use SATA bridges with M.2 SSDs (provided they natively support SATA signaling), ICS-JMR also offers IDE, MicroSATA, e-SATA, ZIF, and 1.8″ IDE adapters for use with the DriveLock. While those adapters were not tested, all of the SSDs and HDDs tested worked perfectly with the DriveLock, including nonstandard drives like the Seagate ST1000DM003, a 3.5″ drive, which is thinner than standard hard disks, and found commonly in small form-factor (SFF) workstations from Dell and others.

Likewise, testing disks on Windows, Mac OS, and Linux went smoothly, with no troubles detecting the drive. Despite several creative attempts in gparted and fdisk on Linux to convince the computer to mount the volume with write privileges, data on the test drives could not be overwritten.

The USB-C to SATA DriveLock is available direct from ICS-JMR for $249.

For more, check out “The desktop is dead, and Intel’s NUC killed it: AMD to build a SFF PC kit” and “Kioxia reveals what to expect in the next decade of flash storage” on TechRepublic.

Image: JMR-ICS