The application
One screen tells you which drives are write blocked.
Every attached disk, its bus, serial and protection state. Unblock a single disk with your password. Nothing else is touched.
FFWB is a forensic software write blocker for labs, workstations and field PCs. Evidence media is write-protected the moment it is connected, on any port, with no hardware bridge in between. Read everything. Change nothing.
Every attached disk, its bus, serial and protection state. Unblock a single disk with your password. Nothing else is touched.
There is nothing to switch on for each drive. Once FFWB is armed, every drive you attach is write blocked automatically, and stays that way until you decide otherwise.
A USB stick, a hard disk in a dock, an SSD, a DVD. Use any port on the machine.
The drive is write-protected before Windows can open it. Nothing on it can be altered, by any program.
Image, hash and browse as fast as the drive allows. Reading is never slowed down.
Release a single drive from the app with your password. Your own system drive is never blocked.
No bridge, no cable adapters, no bus you cannot bridge. The internal SATA bay, the SAS HBA, the front USB socket and the DVD drive are all protected the same way.
Runs with Secure Boot enabled or disabled, on UEFI and legacy BIOS machines. Tested on real hardware, not only in a virtual machine.
Disks attached at boot, at shutdown or while you work are all caught. An unblock you set persists until you re-block it, across restarts.
Releasing a drive or switching protection off asks for the password you set when arming. No one else can quietly turn it off.
Reads never queue through a bridge chip. NVMe on a workstation images at NVMe speed.
Offline licence, bound to the machine or to a USB dongle you carry between PCs. Equip a lab rack, an analyst's workstation or a field laptop without changing the workflow.
Whatever the drive is plugged into, FFWB protects it the same way.
Windows never complains that a drive is write-protected and never tries to "repair" it. You simply work, and the hash you took before matches the hash you take after.
| Protection | Every connected drive is write-protected automatically, including drives attached while the PC is running |
|---|---|
| Read speed | Full native speed of the drive and port |
| System drive | Never write-protected |
| Release | Per drive, password protected, remembered until you block it again |
| Application | Single screen showing every drive, its port and its protection state |
| Operating system | Windows 10 and Windows 11, 64-bit, current releases |
|---|---|
| Firmware | UEFI and legacy BIOS · Secure Boot on or off |
| Interfaces | USBSATANVMeSASSCSIFireWireOptical |
| Licensing | Offline, per machine, signed licence file bound to a Machine ID or Dongle |
| Unlicensed state | Keeps blocking; unblock and disarm are locked |
The demo installs the full driver and application. Protect one drive for 7 days and try to write to it with any tool you like.
FFWB-DEMO.zip · Windows 10 / 11 · x64
We have sent the download link to . The link works for 7 days.
Not there in a few minutes? Check your spam folder, or write to info@fieldforensic.com.
FFWB protects the drive before Windows or any program can reach it, so nothing can write around it. A hardware blocker protects one port; FFWB protects every port on the machine. Many labs use both.
It can't. Nothing is written to the drive, Windows stops asking, and the evidence is unchanged. Your hash before and after will match.
Yes. Protection is per disk. Unblock the destination drive you are imaging to, keep every evidence drive blocked, and the setting is remembered until you change it.
Yes. FFWB runs with Secure Boot on or off, on new UEFI machines and older BIOS machines alike.
No. The disk Windows booted from is excluded by design, so the workstation keeps writing logs, cases and images normally.
The demo protects one drive at a time for 7 days after installation. After that, the blocking stops until you install a licensed version.
Windows updates do not switch FFWB off. Your licence stays valid after updates. If protection ever stops after an update, restart the PC once. If it is still inactive, contact info@fieldforensic.com with your Machine ID and we will send an update for your Windows version.
Offline, with two options. Machine licence: the app shows a Machine ID and you receive a signed licence file for that PC. Dongle licence: the licence is bound to a USB dongle, so you can move it between PCs. Without a licence FFWB keeps blocking but will not let you unblock or disarm.