What is the purpose of write-blockers in forensic collection?

• A. To speed up data acquisition by allowing rapid modifications to the source.
• B. To log every action during collection for audit trails.
• C. To reveal hidden data by bypassing access controls.
• D. To prevent modification of the original evidence during acquisition.

Answer: (D)

Preventing any modification of the original evidence during data acquisition is the key idea. A write-blocker sits between the forensic workstation and the source drive and prevents any writes from reaching the drive while you image it. This ensures the copy is an exact bit-for-bit replica of the original, preserving its integrity for hashing, analysis, and the chain of custody. Without a write-blocker, even small, unnoticed writes—like metadata updates or OS caches—could alter the evidence and compromise admissibility. So the tool’s main purpose is to keep the original data untouched during collection.