First off, use a hardware write blocker if you really want to be
certain nothing is going back to the drive.
Then, you can cover all the bases quite neatly by making multiple
forensic copies of the evidence disk. Allow one to mount "normally".
Mount one with a write blocker. Mount...
First off, use a hardware write blocker if you really want to be
certain nothing is going back to the drive.
Then, you can cover all the bases quite neatly by making multiple
forensic copies of the evidence disk. Allow one to mount "normally".
Mount one with a write blocker. Mount...
[ more ]