Sherlock Forensics USB Write Blocker Every USB Device. Surgical Write Protection. Court-Ready Audit Trail.

Sherlock Forensics USB Write Blocker v1.1.0 uses IOCTL_DISK_SET_DISK_ATTRIBUTES to enforce per-physical-disk read-only access at the Windows kernel level. Each USB storage device is blocked individually the millisecond Windows detects it via PnP arrival notification. The race-window timing between device detection and write-block activation is recorded in the audit log for court evidence.

The live pristine pulse indicator shows a green pulse while zero bytes have been written to a blocked drive. If any write occurs before the block takes effect, the race-window log captures the exact timing so the examiner can assess whether evidence integrity was maintained.

PANIC LOCKDOWN mode provides an emergency global override that blocks all USB storage simultaneously. Per-device controls allow surgical blocking and unblocking from the topology viewer.

Technical Details

Write Block Method

IOCTL_DISK_SET_DISK_ATTRIBUTES per physical disk. Surgical per-device blocking, not a global registry toggle. Each disk gets its own read-only attribute set independently.

Device Detection

PnP arrival notification via Windows device management APIs. Devices detected the millisecond the bus enumerates them. Race-window timing recorded for every block event.

Scope

Blocks USB mass storage class devices (flash drives, external hard drives, USB-connected card readers). Full topology view shows every USB device on the bus including HIDs, audio, cameras and printers. MTP and PTP devices use different protocols and are not write-blocked.

Shadow Mode

Bundled ImDisk virtual disk driver creates a read-only virtual mount of the source disk. Source disk goes offline before mount to prevent duplicate-signature collisions. Works on all Windows editions.

Admin Privileges

Required. IOCTL disk operations and shadow mode driver registration require administrator elevation. The tool prompts for UAC consent on launch.

Audit Trail

Ed25519-signed hash-chained JSONL audit log at %PROGRAMDATA%\Sherlock\usb-blocker\audit.jsonl. Every action timestamped to the millisecond. Public key embedded for downstream verification. Exportable as PDF or JSON forensic report (Pro).

Write blocking is a foundational requirement in digital forensics. When a USB device is connected to a Windows computer without write protection, the operating system can modify the device in ways that compromise evidentiary value. Windows may update access timestamps, create Recycle Bin metadata, write System Volume Information folders or trigger autorun processes. Any of these modifications can alter the hash value of the original evidence and undermine its admissibility in court.

Evidence Integrity

Forensic evidence must remain unaltered from the moment of seizure through final presentation in court. Write blocking ensures that no bits are changed on the suspect device during examination. The forensic image hash will match the original device hash, proving the evidence has not been tampered with. Standards from NIST CFTT and SWGDE require demonstrable write protection during evidence acquisition.

Chain of Custody

Chain of custody documentation must account for every interaction with evidence. Using a write blocker provides a documented control that proves no modifications occurred during your examination. Defense attorneys routinely challenge digital evidence by questioning whether proper handling procedures were followed. A write blocker eliminates the most common attack vector against digital evidence authenticity. See our chain of custody software for complete evidence tracking.

Court Admissibility

Courts in the United States, Canada and most common law jurisdictions expect forensic examiners to use write blocking during evidence acquisition. The Daubert standard requires that forensic methods follow accepted practices in the field. Write blocking is a universally accepted practice. Failure to use write protection can result in evidence being excluded, case dismissal or expert testimony being challenged under cross-examination.

Follow this step-by-step procedure when using Sherlock Forensics USB Write Blocker for forensic USB device acquisition. Document each step in your case notes.

1. Enable Write Protection. Launch Sherlock Forensics USB Write Blocker with administrator privileges. Arm the protection. The tool activates PnP arrival monitoring and will apply per-disk IOCTL write blocking to every USB storage device the moment it is detected. The live pristine pulse confirms zero bytes written.
2. Confirm Protection Status. Verify the status bar shows ARMED with a green protection indicator. The race-window timing in the audit log confirms how fast the block was applied. Screenshot or export the audit log for your case file.
3. Insert the Suspect USB Device. Plug the suspect device into a USB port. Windows will detect and mount the device in read-only mode. You will be able to browse files and read data but all write operations will be blocked by the operating system.
4. Verify the Device is Listed. Open Windows Explorer or Disk Management and confirm the suspect device appears. Verify you can browse its contents. Attempt to create a test file on the device to confirm write operations are blocked. Document the device serial number, capacity and filesystem type.
5. Acquire the Forensic Image. Use your forensic imaging tool (FTK Imager, dd, Guymager or similar) to create a bit-for-bit image of the suspect device. Calculate and record the hash (MD5 and SHA256) of both the source device and the acquired image. The hashes must match to confirm evidence integrity.

Sherlock Forensics USB Write Blocker v1.1.0 uses per-disk IOCTL write blocking with race-window timing. These are the limitations forensic examiners should understand.

Software-Level Protection

v1.1.0 uses IOCTL_DISK_SET_DISK_ATTRIBUTES for per-physical-disk write blocking at the Windows kernel level. This is stronger than the old registry approach but still operates above the hardware layer. A rootkit or kernel-level exploit could theoretically bypass it. For criminal cases or high-stakes litigation where absolute hardware-level guarantees are required, pair with a hardware write blocker. The race-window timing in the audit log provides court evidence of protection speed.

MTP and PTP Devices

Write blocking targets USB mass storage class devices (external drives, USB sticks, SD card readers). Smartphones connected via MTP (Media Transfer Protocol) and cameras using PTP (Picture Transfer Protocol) use different protocols that are not blocked by disk-level IOCTL. Use the topology viewer to identify device classes before handling.

Windows Only

IOCTL disk attributes and the ImDisk shadow mode driver are Windows-specific. This tool does not work on macOS or Linux. For those platforms, use mount -o ro or a hardware write blocker.

Requires Admin Privileges

Per-disk IOCTL operations and the shadow mode driver require administrator access. The tool will prompt for UAC elevation on launch. It cannot run under a standard user account.

Shadow Mode Driver

The bundled ImDisk virtual disk driver installs as a Windows service on first use. While it works on every Windows edition (Home, Pro, Enterprise, Education), the driver registration requires a one-time admin approval. The driver is BSD-licensed open source and installs under a Sherlock-specific service name to avoid conflicts with existing ImDisk Toolkit installs.

v1.1.0 (2026-05-14)

• Per-disk IOCTL write blocking replaces registry-only approach
• Race-window timing closes the gap between insertion and protection
• Live pristine pulse for continuous evidence integrity monitoring
• PnP arrival detection hooks into Plug and Play subsystem
• PANIC LOCKDOWN for emergency system-wide write blocking
• Full USB topology view with hierarchical device tree
• Device history database with serial numbers and timestamps
• Auto-recognize evidence drives with saved profiles
• Shadow mode with bundled ImDisk driver and one-click install
• Auto offline-source for shadow copies
• HID Guard BadUSB defense with configurable modes
• Auto-quarantine for suspicious HID devices
• Persistent allow/deny lists for USB device control
• Ed25519-signed audit log for tamper-evident chain of custody
• PDF and JSON report export for courtroom delivery
• Dark/light theme toggle
• Left rail navigation with collapsible panel
• Auto-update on launch

v1.0 (2026-04-18)

• Per-disk IOCTL write blocking with race-window timing
• One-click enable/disable toggle
• Status verification display
• UAC elevation prompt
• Evidence drive protection for all USB mass storage devices
• Forensic imaging preparation workflow