Write blockers
Reduce the chance of altering source storage during examination.
The idea
A write blocker is a hardware or software mechanism intended to prevent writes to source media while allowing reads. It helps preserve evidence, but its capabilities, configuration, and compatibility must be verified. It does not address every possible change to a live system or storage device. Document the device or mechanism and any tests or limitations. The broader collection process still requires controlled handling and integrity checks.
In practice
A lab investigator connects a training disk through a validated hardware write blocker before imaging it and records the configuration.
A common misunderstanding
Using a write blocker does not replace chain of custody or prove that evidence was unmodified before acquisition.
Check your understanding
Why test compatibility?
Think it through: Unexpected interfaces or device behavior can make a presumed protection incomplete or ineffective.
Prevent writes through the acquisition path
A write blocker is intended to stop write commands from reaching source storage while allowing permitted reading. Hardware and software approaches have different operating assumptions. The device, interface, configuration, and storage type matter, so use a validated procedure appropriate to the actual medium. A label on a cable is not sufficient evidence that source protection worked.
Write blocking addresses one route of alteration; it does not make every surrounding action harmless. Handling, power state, device behavior, encryption, and acquisition errors can still affect what is accessible. Record the setup and test the blocking arrangement with non-evidential media before using it in an investigation.
A fictional external-drive acquisition
An academy receives an external drive relevant to an incident. The examiner records its identity and condition, uses the approved connection path, and acquires a working copy. The acquisition record includes the blocker model or method, settings, software version, errors, and verification information. Analysis proceeds on the copy where feasible.
If the interface is unsupported or the device cannot be read, the examiner should record the limitation and seek an appropriate alternative rather than repeatedly improvise. Some situations require live collection or another method that necessarily changes state. The important distinction is to explain those changes and the reason for the chosen procedure.
Validate with harmless media
Using a training drive containing no important information, describe how an approved laboratory procedure would verify that reads succeed and writes are blocked. Record the test conditions and expected result. Do not assume a successful test on one interface establishes support for all storage types. The exercise should teach validation and documentation, not encourage experimenting on the only copy of real evidence.
Keep exploring
References & further reading
Original explanations, with primary references for deeper study.
NIST: Integrating Forensic Techniques into Incident Response