What is the role of a write blocker in digital forensics?

• A. Encrypts evidence during transfer.
• B. Logs network traffic during imaging.
• C. Prevents modification of evidence storage devices during acquisition.
• D. Allows modification of evidence to aid analysis.

Answer: (C)

A write blocker ensures that the evidence storage devices are not modified during acquisition. It sits between the suspect drive and the forensic workstation, presenting the drive in read-only mode so any attempt to write—by imaging software, the operating system, or a user—will be blocked. This preserves the original data exactly as it was, which is essential for producing a defensible forensic image and maintaining the chain of custody. Some models may log attempted writes, providing an audit trail, but encryption during transfer or network traffic logging are separate functions and not the blocker’s primary role. In short, its purpose is to prevent any modification to the evidence during the collection process.