The makers of the Deepspar Disk Imager recently jumped into the write blocker scene with their Guardonix USB write blocker. They asked me for my opinion and (full disclosure) sent me out a test unit to play with.

The theory behind this write blocker is that it stablises the USB connection whilst also being a write blocker; if Windows encounters a drive with bad sectors or the device fails to respond quickly enough then Windows will drop it and you may not be able to obtain a full image. To use the device you do need to install a small console application, which gives you a degree of granularity over the data that is presented in the logs, as well as how the device should interact with the device (for ex simulated writes, file system mounting, read timeouts etc). I believe that it should even allow you to de-power the device without dropping the imaging sessions but I wasn’t able to test this (see bottom as to why).

Typically with a faulty drive I would move away from the standard forensic imaging utilities and write blockers and use something like the Deepspar Disk Imager or Atola Insight/Taskforce that are a little better at interacting with damaged drives; this is usually because the data is there, but Windows is getting in the way and not letting us make a proper copy. I don’t have access to these types of tools so this write blocker is a much cheaper alternative. Not as fully featured but still an option to consider.

There were two things I was going to test when I received this write blocker; the first being that it functions as a write blocker on some basic tests. The second that it can deal with the myriad of USB drives that I have lying around (some of them are 10-15 years old, so they’ve gotta have some faulty parts to them by now right?), as well as on a drive that was on it’s way out.

Write Blocking!

Now, whilst the write blocker has a USB port on it, I was told that it was primarily for connecting to a dock for hard drives.

I did throw a bunch of old USBs on it and ran a couple of basic tests – attempting to delete a file, format the drive, write to a file using an application (including a hex editor) and all of these writes were prevented which is good!

I did find for some of the USBs that it wouldn’t detect them, which could be because they were older. The Deepspar folks did express that the device wasn’t intended to be used on USB flash drives though, so this tells me to stick to hard drives to improve its reliability.**

Bad Sectors

I had access to a drive that had some read issues* and during the imaging process the Guardonix console identified that it had hit a snag. The console displayed the sector number that had the issue, re-read the sector, and passed that on without FTK Imager being any wiser. Looking at the FTK Imager log, no bad sectors were identified (but it also didn’t identify to me that it had re-read the sector, which was initially confusing).

I did speak to the Deepspar folks about this and asked for a little bit more information in the console when this happens, just for piece of mind. Since then, the software has been updated to advise that it couldn’t read a sector at first, but then successfully re-read it. This will give you a bit more assurance that if a sector is re-read that it’s passed onto the imaging tool.

Overall

Unfortunately (for me), I think I may have fried the device since so I haven’t been able to use it all that much. I managed to pick up the wrong power adapter and I think I let the magic smoke out…but I have to test it out again later on and see if I did actually break it***.
This isn’t necessarily criticism of the device (because it was my fault), but I do prefer the way that the other major vendors control power – the device is powered and passes the required power to the hard drive without an additional adapter.

I think this has potential to be a useful piece of kit. I’m not sure whether I would want it to replace my other write blockers as I’ve found it to be a bit flakey sometimes, but it’s a good tool to have in the toolbox. The flakeyness most likely has something to do with drivers as it was complaining that I didn’t have the best drivers installed. I like the sector map, and the speed graph, just as additional information during an imaging session. I also think that, for the price, it can be a good interim device to have as an option before you drop money on the more expensive data recovery tools.

---

Addendum

I forgot to add a few things!

*Firstly, when imaging the drive with bad sectors – during my initial test of the drive with a different write blocker it would hit the bad sectors and get stuck. The Guardonix was able to keep going without getting caught at the issue.

**I was advised by the company that there was a recent update to assist in dealing with USB drives so once I repair my device I might see how my problem USBs go with it.

***They also said that my burnout situation was covered under warranty and would even provide instructions for me to fix it myself if I wanted (removing the overvoltage protection IC and a bit of soldering)