During evidence collection, which device is used to prevent the system from writing data to the evidence disk?

• A. Firewall
• B. Write-blocker
• C. Protocol analyzer
• D. Disk editor

Answer: (B)

Preserving evidence integrity is the goal. A write-blocker is placed between the evidence disk and the system to block any write commands from the host while still allowing reads. This lets forensic imaging tools create a bit-for-bit copy without altering the original media, ensuring hashes remain valid and the chain of custody is intact. Without a write-blocker, normal system activity could modify data, timestamps, or slack space and compromise the evidence. The other options don’t prevent writes to the disk: a firewall protects network traffic, a protocol analyzer captures data, and a disk editor would modify disk contents.