Open Forensic DeviceWrite protection
A filtering bridge that passes read commands to the source device and refuses everything else, with the refused commands kept in the log.
An open reference design for write‑protected evidence acquisition
Open Forensic Device is a documented hardware and software stack for imaging storage media in the field: a write blocker, a hashing pipeline and an acquisition log that can be inspected, rebuilt and tested by anyone.
About
Commercial acquisition tools are closed, expensive and hard to validate. Courts increasingly ask how a tool behaves, not only what it produced. An open design lets examiners, trainers and researchers check each step: which commands reach the device, how the image is hashed, and what the log records.
Design
Imaging
Sector-by-sector copy to raw or segmented images, with MD5, SHA-1 and SHA-256 computed while the data streams.
Acquisition log
A plain-text record of the device identity, timings, read errors and hashes, signed at the end of the session.
Validation
Test images with known content and a procedure for checking a build before it is used on real evidence.
Status
The design notes and test material are being prepared for publication. This page will link to them when they are ready.