227k views
0 votes
Discuss in detail why you need to use a write blocker (either hardware or software) in your examinations, whether for a criminal case or a corporate case.

User Yoely
by
7.4k points

1 Answer

2 votes

A write blocker is any tool that permits read-only access to data storage devices without compromising the integrity of the data. A write blocker, when used properly, can guarantee the protection of the data chain of custody. NIST‘s general write blocking requirements hold that:

The tool shall not allow a protected drive to be changed.The tool shall not prevent obtaining any information from or about any drive.The tool shall not prevent any operations to a drive that is not protected.
User Iconoclast
by
8.6k points