During Windows forensics, which device helps prevent contamination to the evidence drive during acquisition?

• A. Automate collection from image files
• B. A hardware write-blocker
• C. A software write-blocker
• D. Copy directly to the suspect drive

Answer: (B)

Preventing contamination of the evidence drive during acquisition requires a tool that stops all writes to the evidence media. A hardware write-blocker sits between the evidence drive and the acquisition workstation and physically blocks write commands at the hardware level, ensuring nothing can alter the drive's data while you image it. This guarantees the original state of the evidence is preserved, which is essential in Windows forensics where the system and tools can otherwise cause incidental changes.

Software write-blockers rely on the operating system to suppress writes and can be bypassed or bypassed by certain processes, caches, or updates, making them less reliable for maintaining strict immutability. Copying directly to the suspect drive would contaminate the source, and automating collection from image files doesn’t address protecting the evidence during the initial capture. Therefore, the hardware write-blocker is the best option to maintain evidence integrity during acquisition.