Reddit reviews Coolgear USB 3.0 / 2.0 to IDE/SATA adapter with Write-Protection

I recommend pulling the hard drive and using it in a hard drive dock that has a Read Only mode.

Simply placing it in another computer will be less likely to write data but it's still a possibility.

Every bit of data that gets written to the hard drive has a chance of writing over the data that has been marked for deletion.

You see, when you delete a file, a tombstone, typically an omega symbol gets placed at the beginning of the data of each file, "marking" the files for deletion.

The data is still there, but that data has been marked as free space for other data to write into. If one byte of data is written into the data of a file, it corrupts that file and it's not recoverable by basic means.

A Read Only hard drive dock will allow you to pull any data off of the drive but will not allow you or any software to write data to it, preserving the data.

This will allow you to use programs such as Piriform's Recuva to search for files and restore them without the chance of corruption.

Read only can also be called Write Protection, Write-block, write-locked, etc.

Here is a dock that can do such a thing

Assuming you're never going to use this as evidence in a case: the quick and easy answer is using something like AUTOPSY.

Install, then use an interface such as a COOLGEAR with a writeblocker ( https://www.amazon.com/Coolgear-SATA-Adapter-Write-Protect-Selection/dp/B005C55OYA/ref=sr_1_fkmrnull_1_sspa?keywords=cool+gear+write+blocker&qid=1555893161&s=gateway&sr=8-1-fkmrnull-spons&psc=1 ) to mount the drive.

You can find tutorials on how to use AUTOPSY on youtube. Find what you need and "export" the files to your local disk. Done.

If you don't mind a hardware solution there are forensic write blockers, like when you have to absolutely keep something 100% read-only. Like this one below is not too expensive and appears to be enabled/disabled easily.

(this one is for hard drives)

https://www.amazon.com/Coolgear-SATA-Adapter-Write-Protect-Selection/dp/B005C55OYA

​

If you are looking for USB there are some great solutions out there, but here is a great DIY one:

https://www.instructables.com/id/Cheap-and-Effective-USB-Write-Blocker/

You need a USB write blocker, and a Virtual Machine. The blocker is $50 and there is free VM such as Virtual Box. Configure the VM to grab the USB on insertion.

You could also use a bootable Linux distro, though that would not protect mountable hard drives.

Find guides for setup and analysis through SANS.

Stop using the drives immediately. You don't want data to overwrite the data you need to recover.

You're going to want to get your hands on a new drive that you can move your recovered data to. USB / SATA doesn't really matter just make sure you're not recovering data onto the drive you're recovering from.

If you want to be really safe get a write-blocker like this LINK and hook the drive to be recovered from on there. (I used to do onsite forensics and this tool worked well)

Then use recovery software like PhotoRec or TestDisk LINK and allow them to run. Make sure you select options for all file types that you want to recover. Select the most intensive recovery option and let it run overnight if you have to.

Remember, the files you recover likely won't have file names so you'll have to go through everything and sort it yourself.

Good luck!