THIS PROGRAM IS A DOS APPLICATION THAT WILL NOT FUNCTION IN WINDOWS
With operating systems becoming more and more complex it is increasingly difficult to protect fragile computer evidence. PDBLOCK (Physical Drive BLOCKer) is a standalone DOS utility designed to prevent unexpected writes to a physical disk drive. When PDBLOCK is executed on a computer its job is to prevent all writes to the physical drives. Handling both the standard Interrupt 13 and the Interrupt 13 Extensions, PDBLOCK is designed to be the next generation of write blockers providing protection for Large Hard Drives, FAT32(x), DOS 7.1.
The fact that existing write blockers are ineffective at preventing writes to hard drives on systems running DOS 7.1 (Win95-OSR/2) and above is not news to the computer forensics community. However, are you aware that these write blockers are also incapable of protecting systems running earlier versions of DOS (like version 6.22)? That's right! New tools are rapidly entering the market which are capable of making an end-run around the best of the "old technology" write blockers even when booted with a DOS forensic boot floppy!
Utilities that Digital Intelligence has tested that elude traditional blockers when run under DOS 6.22 include the latest Symantec DiskEdit V4.5, as well as DI's own PDWIPE and DRIVESPY programs. Who else knows what else is out there legitimate or not?
The situation with DOS 7.1 and above is so bad that even a simple COPY operation will circumvent older technology blockers if the O/S is installed on a large hard drive with a FAT32x partition! (No special utilities required to circumvent the blockers).
Given the urgency of the situation, Digital Intelligence has extended its services to the Law Enforcement community and is providing the "LITE" version of PDBLOCK (PDB_LITE) free of charge to all Law Enforcement Agencies and Personnel. Our tests indicate that it effectively traps all hard disk writes that use the newer Interrupt 13 extensions as well the functions used in older technologies. Tests indicate that this blocker effectively captures the writes associated with DOS 7.1 accessing large hard drives using FAT32 as well as the above mentioned "new technology" utilities regardless of O/S.
Although PDB_LITE is quite effective at blocking write requests to all hard drives on a system, it may be desirable to selectively control the blocking operation on a drive-by-drive basis. With the recent release of PDBLock V2.0, the following features have been added to PDBLOCK:
* Selectively control which drives are write protected (useful for doing Drive-to-Drive) images)
* Enable/Disable Audio feedback (Bell) when writes are blocked
* Enable/Disable Visual feedback (Messages) when writes are blocked
* Control whether a failure code (write protect) or success code is returned to the calling program when writes are blocked
Furthermore, all these controls can be adjusted on the fly after the program has been loaded!
Download PDB LITE Documentation for Additional Information (PDF)
Download PDBLOCK Documentation for Additional Information (PDF)