Forensic disk controller

A forensic disk controller or hardware write-block device is a specialized type of computer hard disk controller made for the purpose of gaining read-only access to computer hard drives without the risk of damaging the drive's contents.

The device is named forensic because its most common application is for use in investigations where a computer hard drive may contain evidence.

Steve Bress and Mark Menz invented hard drive write blocking (US Patent 6,813,682).

[3]Forensic disk controllers intercept write commands from the host operating system, preventing them from reaching the drive.

Additionally, the NTFS file system may attempt to commit or rollback unfinished transactions, and/or change flags on the volume to mark it as "in use".