What is the purpose of a write-blocker?

• A. Prevent reading from the evidence disk
• B. Prevent writing to the evidence disk
• C. Speed up imaging
• D. Encrypt the data during imaging

Answer: (B)

A write-blocker is used to allow access to the evidence drive without letting anything on the drive be modified. It sits between the drive and the imaging workstation and prevents any write actions—from the operating system or forensic tools—while still permitting read access. This ensures the original data on the evidence remains exactly as it was, which is essential for preserving integrity and maintaining a solid chain of custody. It’s not about preventing reads, speeding up imaging, or encrypting data; its single, critical role is to block writes to the source evidence during acquisition.