Skip to content
CyberHardware

U6 · Topic

Forensic acquisition hardware

Evidence that was modified during acquisition is evidence you may lose in court. This area covers hardware and software write blocking, standalone imagers, NIST CFTT testing, SSD and NVMe pitfalls, and how to validate your own kit.

  • Write blocker
  • Imager
  • E01

Guides in this topic

  1. Forensic write blockers and disk imagers: a buyer's guide

    Hardware versus software write blocking, standalone imagers, NIST CFTT testing, SSD and NVMe pitfalls, HPA/DCO checks and a validation routine for your own acquisition kit.