What is the primary purpose of a write-blocker in digital forensics?

What is the primary purpose of a write-blocker in digital forensics?

• A. To Prevent Modification of Evidence During Acquisition
• B. To Speed Up Data Copying
• C. To Encrypt Data
• D. To Compress Data

Answer: (B)

Preventing modification of evidence during acquisition. A write-blocker sits between the evidence drive and the forensic workstation and blocks any attempt by the system or user to write to the source device. This ensures the original data remains unchanged, which is essential for preserving the chain of custody and the integrity of the evidence. The imaging process can read data through the blocker to create an exact copy, but no writes—such as metadata updates or temporary changes—are allowed on the source. It’s not about speeding up copying; it may add a slight overhead, and it does not encrypt or compress data. After imaging, verify the copy with hash comparisons to confirm it matches the original state.

Preventing modification of evidence during acquisition. A write-blocker sits between the evidence drive and the forensic workstation and blocks any attempt by the system or user to write to the source device. This ensures the original data remains unchanged, which is essential for preserving the chain of custody and the integrity of the evidence. The imaging process can read data through the blocker to create an exact copy, but no writes—such as metadata updates or temporary changes—are allowed on the source. It’s not about speeding up copying; it may add a slight overhead, and it does not encrypt or compress data. After imaging, verify the copy with hash comparisons to confirm it matches the original state.