What is the primary purpose of a write blocker in forensic image acquisition?

• A. Speed up imaging by skipping metadata.
• B. Encrypt the data to protect confidentiality during transfer.
• C. Prevent modification of the source evidence during imaging, preserving data integrity and defensible chain of custody.
• D. Allow live memory to be captured during imaging.

Answer: (C)

Write blockers are used to ensure the source evidence is not altered during imaging. They sit between the evidence drive and the imaging workstation, allowing read access but blocking any write commands. This guarantees that the original data, including timestamps and metadata, remains exactly as it was when collected. Because nothing can be written to the media during transfer, you can compute and compare cryptographic hashes on the original media and the acquired image with confidence, demonstrating the image is a faithful, defensible copy. Maintaining this unmodified state is essential for the chain of custody and for the evidence to be admissible in court. It's not about speeding up imaging, encrypting data during transfer, or capturing live memory, which require different tools and processes.