Re: Converting an external hard drive enclosure into a write blocker?

Well this is a little one sided.

When you are preserving a hard disk you want a snapshot in the moment
it was seized. This would mean that you should not do any alteration
after that point and I'll ask you to consider two cases that will show
you where I come from.

1. The journal replay may overwrite some chunks of data you may want
to have linked the way they were. I.e. somebody did "rm -rf /" the
moment the agents were serving a no know warrant (and if they turned
off the machine the files will be still linked).

2. The kernel of the system you are running may have a bug that may
result in a different behavior than the system being investigated. (or
vice versa the system may had "special patches" applied that might
cause your data replay to corrupt data.
Even further think about a patch that ignores certain records of the
journal file and those records when applied by a "unpatched kernel"
unlink certain files (or overwrite them with random data).
You should also do separate analysis on the journal itself to
determine what contents it contains.
Having said all that I do not reject the ability to present as a
separate evidence replayed journal (*and note you did that*) to the
investigators/court.

Regards,
Krassi