What is the primary purpose of a write blocker during disk imaging?

• A. To decrypt data
• B. To store the image
• C. To speed up imaging
• D. To prevent modification of the original evidence

Answer: (D)

Preventing modification of the original evidence is the primary purpose of a write blocker during disk imaging. A write blocker sits between the evidence drive and the imaging workstation and blocks any commands that would write to the source, while still allowing read access so the data can be copied exactly. By stopping writes, the drive’s contents remain unaltered, which is essential for preserving the integrity of the evidence and for later verification that the copy is a true, exact replica. This exact bit-for-bit copy can then be hashed to demonstrate that no changes occurred, supporting the forensic chain of custody and admissibility. The blocker’s role isn’t to decrypt data, store the image, or speed up imaging. It focuses solely on preventing alterations to the original during the imaging process.