Digital Forensics 0x2a : Write Block using Winhex [Step by Step Guide]

Write Blocking ensures contents do not get modified during the period of investigation. Write blocking can be done either software or hardware based.

In digital forensics, after creating disk image, hashing and write blocking are most important step to be taken to ensure the integrity of captured evidence.

We will learn : 

- Write block a disk image file using WinHex 

- Write block a disk image file using file properties and read-only.

1. Open image file we created in Winhex as shown in image below.

2. Go to options and then to Edit Mode. Screen like below will appear.

3. Select ‘Read only mode’ and click OK.

Next basic thing is :

Right click your disk image file, go to properties, in attributes click read only and apply.

My this article is also published on Cybrary Op3n Content.

Ref. nest.unm