Question

Discuss in detail why you need to use a write blocker (either hardware or software) in your examinations, whether for a criminal case or a corporate case.

Answer 1

A write blocker is any tool that permits read-only access to data storage devices without compromising the integrity of the data. A write blocker, when used properly, can guarantee the protection of the data chain of custody. NIST‘s general write blocking requirements hold that:

The tool shall not allow a protected drive to be changed.The tool shall not prevent obtaining any information from or about any drive.The tool shall not prevent any operations to a drive that is not protected.