Product Review: Wiebetech USB WriteBlocker
I've lost count of how often I've brayed, "Lawyers have lost touch with the evidence." We've lost our ability to dive right into the data when a new client comes in--at least if the client brings a hard drive or thumb drive. No lawyer with half a brain plugs electronic evidence into his or her own computer and pokes around because, by now, most lawyers know about metadata, and appreciate that they can alter evidence simply by browsing it. Can you say "spoliation?" I knew you could.
But the alternative is also pretty ugly, being lawyers treating electronic evidence like it's radioactive. It's sent out to expensive vendors and experts while lawyers wait days or weeks to see what's there. Wouldn't it be great if lawyers lacking technical prowess could quickly and safely wade into the client's digital files and see what's what?
Computer forensic examiners dodge the spoliation bullet by employing tools and techniques called "write protection" that intercepts changes to electronic media. Write protectors a/k/a "write blockers" can be either hardware devices or software applications. Hardware write blockers provide tangible, visual assurance that data is well protected against its greatest enemy, being not heat, electrostatic discharge or shock, but human error. Having a hardware write blocker at hand enables a lawyer to start looking at the electronic evidence immediately and start asking the right questions, all without fear of inadvertent spoliation.
I've hesitated to advocate that litigators need write blockers because, simple as they are, most hardware write blockers are still too complicated for lawyers. Too, they've long been pricey gadgets and, until lately, you needed one for IDE hard drives (with adapters for notebook drives) and another for SATA drives, along with power supplies and cables and such.
But strolling the aisles of a recent computer forensics confab, I happened across a nifty little hardware write blocker that any Luddite lawyer can use. The Wiebetech USB WriteBlocker is a dead simple gadget that looks like a thumb drive on steroids. First, you plug the device to be write blocked into the USB port of the Wiebetech USB WriteBlocker, then you plug the Wiebetech WriteBlocker into the USB port of the computer you'll use to peruse the evidence. The computer sees the contents of the evidence just as if you'd plugged it in sans write blocker, but all changes to the evidence are intercepted.
Do you need to examine a thumb drive or external hard drive without stomping on the evidence? With this self-powered, plug-and-go device, it's a cinch. "But, wait!" you say, "what about the hard drives inside desktops and laptops? They don't use USB connections!" Indeed, they don't; but, a few bucks buys a cable and power supply that allow you to connect laptop and desktop IDE and SATA drives to a USB port. With that cheap, easy USB connectivity, you're back in business with the USB WriteBlocker.
I tested the wiebetech USB WriteBlocker pretty thoroughly to satisfy myself that it performed as promised. I hashed various thumb drives, an external hard drive and both a SATA and IDE internal drive before connection, then tried to write to them in various ways. Hashing them again, I found no alterations at all. Every write effort was duly intercepted.
At $200.00, it's not something for every lawyer's keychain; but for law firm and corporate IT staff, and particularly for those conducting deskside interviews of custodians in e-discovery, it's a great gadget. It's also handy for checking out drives of departed employees to see if there's evidence of deletion, data theft or other abuse. You improve your odds in court in these cases, if you haven't corrupted the metadata.
Finally, the Wiebetech USB WriteBlocker comes with a software program that interrogates devices to glean their serial numbers. That's a useful e-discovery feature as it can be challenging to differentiate one thumb drive from another, especially when everyone went to the conference where they handed out identical thumb drives.
I'd like to see it at a lower price point, particularly as there are free--though less desirable--software alternatives, but even one case today can easily justify the cost of this handy, well-engineered device.