One of the foundations of forensic examination of digital media is preserving the integrity of the media throughout the investigation. A single unintended change to a device can compromise the entire case. Before connecting any evidence device to a collection system, the examiner must activate a software or hardware write blocker.

What are Write Blockers?

A write blocker is a hardware or software tool that allows a forensic examiner to access data on a storage device without permitting any changes to be written back to it. In simple terms, it makes the evidence "read-only." Hard drives are typically connected through a hardware write blocker, which intercepts write commands that the operating system may automatically attempt to send to the media.…