Write Controller

Spread the love

1: Introduction – About Write Controller

What is Write Controller?

Write Controller is a software write-blocker. It allows the user to prevent Mac OS X from automatically mounting volumes when they are attached to the Mac and therefore prevents accidental writing to the evidence drives. This allows a forensic examiner to image or explore the drive without fear of writing to it and compromising evidence. It offers an additional layer of security to prevent writing in addition to traditional hardware write-blockers.

Write Controller Feature

Write Controller offers the user the ability to enable and disable automatic mounting (also known as Disk Arbitration) with the single click of a button.

2: Getting Started – The Basics of Write Controller

Write Controller is programmed to run on the following minimum specification:

  • Intel based Dual Core Apple Macintosh CPU
  • Mac OS X Version 10.6 or above (Built for OSX Mavericks)
  • 1 GB of RAM
  • Hard Disk (with 30 mb of space free for installation)

Not compatible with OSX 10.11 and 10.12.

Installing or Updating via Download

Once the software has been downloaded from the site and decompressed, the user can drag and drop Write Controller from the mounted disk image into the Applications folder. If prompted to replace the existing version of the file, click Replace.

End User License Agreement

The first time the application is launched the user will be asked to accept the End User License Agreement and then to enter a valid registration number.

Enter Serial Number

Having done entering the serial number the user will be asked the administrator user password for the installation of files to the host computer. Once correctly entered, the necessary files will be added to the system, the user will then be taken to the Main Window.

The password is your administrator password, and not something assigned by us. If you don’t have a password (blank), you will need to assign one to the system to use MacImager.

To add a password, open your System Preferences… under the Apple menu. Click on Account
Then click on Change Password…and enter a new password. The user will be taken to the Main Window.

main window

Finding Help & Technical Support

Should the investigator need assistance working with Write Controller there are a number of sources through which to get help:

Help within Write Controller

The investigator can find from the Help drop menu, which offers the option to “Show Help”, taking the investigator other relevant web pages on the SubRosaSoft web site.

Technical Support

Our technical support is free via email and can be accessed at the following address: support@subrosasoft.com. The support hours are 10am to 6pm Pacific Standard Time Monday to Friday.

In addition to any support question(s), the investigator must include ALL of the following pieces of information:

  • Purchase information.
  • System configuration(s) – hard drive make, model etc.
  • System OS version.

System related information can be found by using the “System Profiler” application in the /Applications/Utilities folder.

3: Using Write Controller – Navigating the Windows & Using the Functions

The Main Window

Immediately after start-up, the investigator will be presented with the Write Controller splash screen. Once this has disappeared, he or she will then be taken to the ‘Main Window’.

Write Controller main window

The Layout

The main window layout can be effectively divided into two sections: a panel for selecting device to be acquired and a Start button at the bottom.

Enabling and Disabling Automatic Mounting

Whether at start-up or when connecting a suspect device via any data bus (FireWire, USB, ATA) on your Macintosh Workstation, OS X is notified and will immediately look for mountable partitions on the device.

If detected, it initiates the mount and the disk’s internal arbitration tables are updated with the necessary information to work with the system. Having mounted, the Finder is updated with the information and the volume(s) appear on the desktop. Any other applications that may have subscribed to disk arbitration notifications are also updated in a cascade effect.

In the process of finding and updating the arbitration tables on devices found and mounted, there runs the risk of writing to the devices and therefore tainting the evidence. Write Controller allows the user to enable and disable this automatic mounting and prevent accidental writing to a volume.

By default in Mac OS X, automatic mounting is enabled. To disable this, simply click the Disable button in the Mount Status area at the top of the Write Controller window.

Write Controller's Disable Button

This will disable auto mounting. Once automatic mounting has been disabled, the user may then connect a suspect device to their forensic workstation.

Once the user is done imaging the suspect device and/or exploring it, they will want to enable auto-mounting once again as leaving is disabled can create problem in the operating system during the next reboot. To enable automatic mounting agin, simply click the Enable button in the Mount Status area of the Write Controller window.

Write Controller's Enable Button

The operating system will now automatically mount volumes when they are connected to the computer.

Quick Tip: Quick Tip: Mounting a Device
It should be noted that mounting a device may affect evidence and unless a write blocker is used, an investigator should not mount a device that he or she wishes to perform a Write Controller upon.

4: Appendices – Getting Help and Technical Support

Finding Help within Write Controller

Help can be found both via the standard help menu at the top of the screen.

On the Web

We provide over 100 links to forensic resources, manuals, a complete knowledge base and a plethora of additional information on our website. For updates, resources and additional information please visit: https://www.subrosasoft.com

Technical Support

We provide free technical support both via email or phone during the hours 10am to 6pm Pacific Standard Time (GMT -8) Monday to Friday. By email, we can be reached at the following address: support@subrosasoft.com. By phone, we can be reached at: +1 (510) 870 7883, or by fax on +1 (510) 868 3407.

In addition to any support question(s), the examiner must include ALL of the following pieces of information:

  • Valid purchase information.
  • System configuration(s) – hard drive make, model etc.
  • System OS version.
  • System related information can be found by using the “System Profiler” application in the -/Applications/Utilities folder.

Comments and Questions

If you have comments, problems, or questions about this product, or if you are interested in a site license, please contact us via email: info@subrosasoft.com