During evidence collection, which device is used to prevent the system from writing data to the evidence disk?

During evidence collection, which device is used to prevent the system from writing data to the evidence disk?

• A. Firewall
• B. Write-blocker
• C. Protocol analyzer
• D. Disk editor

Answer: (B)

Preserving evidence integrity is the goal. A write-blocker is placed between the evidence disk and the system to block any write commands from the host while still allowing reads. This lets forensic imaging tools create a bit-for-bit copy without altering the original media, ensuring hashes remain valid and the chain of custody is intact. Without a write-blocker, normal system activity could modify data, timestamps, or slack space and compromise the evidence. The other options don’t prevent writes to the disk: a firewall protects network traffic, a protocol analyzer captures data, and a disk editor would modify disk contents.

Preserving evidence integrity is the goal. A write-blocker is placed between the evidence disk and the system to block any write commands from the host while still allowing reads. This lets forensic imaging tools create a bit-for-bit copy without altering the original media, ensuring hashes remain valid and the chain of custody is intact. Without a write-blocker, normal system activity could modify data, timestamps, or slack space and compromise the evidence. The other options don’t prevent writes to the disk: a firewall protects network traffic, a protocol analyzer captures data, and a disk editor would modify disk contents.