Feeds

Storage forensics – it's CSI:Disk array

Red ports don't write, says WiebeTech

Internet Security Threat Report 2014

Forensic storage developer WiebeTech has developed a pair of write-blocked PCIe adapter cards that connect to devices such as disk drives or arrays, but prevent the host computer from writing to them.

The RedPort cards allow an investigator to study or copy stored data without the risk of accidentally altering it, according to WiebeTech CEO and president James Wiebe. He claimed that if you make a normal host adapter read-only it may still be possible to reverse that in software.

"A primary design task was to ensure that an investigator would not be able to turn a RedPort card into a read/write card by accidentally installing the wrong software drivers," he said. "Thus, either RedPort works write-blocked, or it doesn't work at all."

The reason for doing read-only adapter cards is that WiebeTech's other forensic gear only connects to individual hard drives. That's a bit of a pain if you have a multi-drive array to copy – more so if those drives are part of a SAN or a RAID set.

The RedPort cards each provide two write-protected 4Gig Fibre Channel or Ultra320 SCSI connectors. WiebeTech said they're called RedPort because the ports are red. Actually, they're not – the back panel plates are striped red, but the effect is similar.

They're not cheap – they list at £1,769 and £719 respectively – but that's not much compared to the cost of losing a court case because you damaged the evidence. The cards use ATTO hardware with modified firmware, and are distributed in the UK by AM Micro. ®

Beginner's guide to SSL certificates

More from The Register

next story
Docker's app containers are coming to Windows Server, says Microsoft
MS chases app deployment speeds already enjoyed by Linux devs
'Hmm, why CAN'T I run a water pipe through that rack of media servers?'
Leaving Las Vegas for Armenia kludging and Dubai dune bashing
'Urika': Cray unveils new 1,500-core big data crunching monster
6TB of DRAM, 38TB of SSD flash and 120TB of disk storage
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
SDI wars: WTF is software defined infrastructure?
This time we play for ALL the marbles
Windows 10: Forget Cloudobile, put Security and Privacy First
But - dammit - It would be insane to say 'don't collect, because NSA'
Oracle hires former SAP exec for cloudy push
'We know Larry said cloud was gibberish, and insane, and idiotic, but...'
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.