What is a write blocker and why is it used in disk forensics?

• A. A device that accelerates write operations
• B. A device that prevents write access to a suspect drive while enabling read access; preserves evidence from alteration.
• C. A forensic keyboard for inputting commands
• D. A software tool that duplicates disk image

Answer: (B)

The key idea is protecting evidence by controlling how data can be written to a suspect drive while still allowing reading of its contents. A write blocker is a device (usually hardware) placed between the storage medium and the computer used for analysis. It stops any write commands from the host, so the original drive cannot be altered, while still permitting read access so investigators can view and image the data. This guarantees the original state of the media remains intact, which is essential for maintaining the evidentiary chain of custody and for producing a verifiable forensic image whose hash matches the original media.

It’s not about speeding up writes, which would risk contaminating or altering evidence. It’s also not a keyboard or a tool dedicated to data input, nor is it primarily a software program that duplicates a disk image—imaging is performed with other software, and the blocker’s role is to prevent writes during the process. A hardware write blocker is preferred for strong, hardware-enforced write protection, though software-based approaches exist, they may be less trustworthy in ensuring no writes occur.