Write Blocker
Definition
A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching the source medium. Use of a write blocker is the baseline standard for forensic acquisition; its absence means the examiner cannot demonstrate the source was not altered during imaging.
- Function
- Allows read access while physically or logically preventing write operations to storage media
- Form
- Can be hardware (external device) or software (driver layer)
- Used with
- Hard drives, USB media, SD cards, and other storage during forensic imaging
Common questions
Why do forensic examiners use write blockers during imaging?+
A write blocker prevents any modifications to the original evidence while it's being read. This is critical for maintaining chain of custody and authenticity. Without one, the imaging process itself could alter timestamps, file systems, or other data on the suspect drive, making the evidence legally questionable.
What happens if you image a drive without a write blocker?+
The imaging workstation or software can accidentally modify the original data, including file allocation tables and access timestamps. This contamination breaks the chain of custody and may make the evidence inadmissible in court. A write blocker sits between the drive and the imaging system to intercept and block all write commands before they reach the original.
Can a write blocker be software instead of hardware?+
Yes. A write blocker can be either a hardware device or a software driver layer. Both work the same way: they read data from the suspect drive while preventing any write operations. The choice depends on the imaging setup and the types of storage media being examined.
Related terms
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Forensic Image
- A bit-for-bit verified copy of a storage medium, created using a write-blocker to prevent modification of the original. The copy is verified...
- Hash Value
- A fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical...
- Order of Volatility
- The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and...
- Faraday Bag
- A signal-blocking pouch with conductive mesh lining that prevents cellular, Wi-Fi, Bluetooth and NFC signals from reaching a seized phone. The standard...
- Working Copy
- A copy of an exhibit on which examination work is performed, created from a verified forensic image. The original or master copy...
- ACPO Principles
- Four principles for digital evidence handling published by the UK's Association of Chief Police Officers (now maintained by the Forensic Science Regulator):...
- Authentication
- The process of establishing that a document is what it purports to be. Under the US FRE Rule 901, the proponent must...
- Best Evidence Rule
- The principle, codified in FRE Rule 1002, that the original of a document is required to prove its content. Under Rule 1003,...
- Bit-Stream Image
- Sector-by-sector exact copy of a storage medium, including unallocated and slack space. Created with dd, FTK Imager, EnCase or X-Ways. Output formats:...
- BSA 2023 Section 63 Certificate
- Mandatory certificate accompanying any electronic record produced as secondary evidence in Indian court. Replaces IEA Section 65B from 1 July 2024. Signed...
- Chain of Custody Log
- The continuous record documenting every person who accessed a digital exhibit, every transfer of possession, every examination action, and the hash values...
Explained in these topics
- CCTV and DVR Systems: Architecture and Evidence AcquisitionA hardware or software device that intercepts all write commands sent to a storage medium, allowing the examiner to read data without modifying timestamps, fil...
- Chain of Custody for Digital MediaA hardware device or software control that allows read commands to pass to a storage medium while intercepting and discarding write commands. Prevents any acqu...
- Chain of Custody for Media EvidenceHardware or software that intercepts write commands to storage media during forensic imaging, permitting reads but preventing any alteration. Required when ima...
- Computer Forensics: Cyber Crimes, Digital Evidence, Seizure and AcquisitionHardware or software device that allows read commands to a suspect drive while intercepting all write commands. Mandatory between the suspect drive and the ima...
- Cyber Investigation Reporting and Court PresentationHardware or software that prevents any write operation reaching a source device during forensic acquisition. Its use, or a documented explanation for why it co...
- The Digital, Document and Engineering SciencesA hardware or software device that allows data to be read from a storage medium while preventing any write operations. Its use is a standard requirement in dig...
- Digital Evidence in Mobile and Network ContextsA hardware or software device that allows a forensic examiner to read data from a storage medium without permitting any write commands to pass back to the devi...
- The Digital First Responder: Order of Volatility, Seizure and ImagingA device or driver layer that lets the examiner read a source disk while physically or logically preventing any write back to it.
- Documentary Evidence and Chain of Custody in Fraud AuditsA hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching the sourc...
- Evidence Collection and Chain of CustodyA hardware or software device that prevents any write operations to a storage device during forensic imaging. It ensures the image process does not alter the o...
- Evidence Preservation During ContainmentA hardware or software device that intercepts write commands to a storage medium and prevents them from executing, while allowing read commands to pass through...
- Forensic Readiness and Response ToolkitsA hardware or software device that allows a forensic examiner to read a storage medium without permitting any writes to it. Essential for preserving the integr...
- Intake, Scoping and Evidence PreservationA hardware or software device that allows data to be read from storage media without any write operations being sent back to the original. Mandatory for forens...