SESK: Stuff Everyone Should Know · sesk.info/secplus-write-blocker-imaging
In digital forensics, what is a write-blocker used for?
It prevents writes to the original media while you image it.
- Encrypt the suspect disk
- Recover deleted files automatically
- Prevent writes to the media being imaged ✔
Why: Plugging a drive into a normal computer can change timestamps and data. A write-blocker allows reads but stops writes, so the original evidence stays untouched. Analysts then work from a copy.
Huh, didn't know that: NIST says write-blockers can be hardware or software based.
What do you call a cat who wants to sit on you while you're working? A laptop.
Like this card?
References
Answer: Prevent writes to the media being imaged. Plugging a drive into a normal computer can change timestamps and data. A write-blocker allows reads but stops writes, so the original evidence stays untouched. Analysts then work from a copy.
- NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-86.pdf
A write-blocker is a hardware or software-based tool that prevents a computer from writing to computer storage media connected to it.
Checked 2026-10-10.
Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.
More stuff everyone should know
Security & PrivacyWhen collecting evidence from a live compromised system, which data should you capture first?Security & PrivacyAccording to RFC 3227, what should you avoid doing to a compromised system until evidence collection is complete?Security & PrivacyWhat does a chain of custody record for digital evidence?
That's stuff everyone should know.