Write Blockers
Hardware device or software application that enables read only access to digital evidence
The write blocker ensures data integrity, since no data is modified or added to the evidence drive
Most operating systems mounts connected devices automatically, modifying files' metadata; hence it is essential to use a write-blocker
Essential features search in hardware write blockers include:
- Available connection types: does it support SATA, IDE, or both drive types? does it only support USB 3.0, or 2.0 as well?
- Writing capability: Does it allow you to switch between read-only and read-write modes?
- Compatibility: You need to check if it is compatible with Advanced Drive Formats
"In general, when using a hardware write-blocker, the media or devices used to read the media should be connected directly to the write-blocker, and the write-blocker should be connected to the computer or device used to perform the backup imaging"
"When using a software write-blocker, the software should be loaded into a computer before the media or device used to read the media is connected to to the computer"