CompTIA Security+ (SY0-701)Security OperationsMedium
A digital forensics examiner must create a forensic image of a suspect's storage drive while guaranteeing that no data on the original drive is modified during the acquisition process. Which piece of equipment should the examiner use?
- AFaraday bag
- BHash calculator
- CWrite blocker
- DEvidence log form
Show answer & explanationAnswer & explanation
Correct answer: C. Write blocker
A write blocker sits between the original drive and the forensic workstation, allowing data to be read and imaged while physically or logically preventing any write commands from reaching the source drive, preserving its integrity. A Faraday bag blocks wireless signals, a hash calculator verifies integrity after acquisition, and an evidence log tracks custody rather than preventing writes.
Why the other options are wrong
- A. Faraday bags block RF signals to prevent remote wipe on mobile devices, not disk writes.
- B. Hash calculators verify integrity after imaging but don't prevent writes during acquisition.
- D. Evidence log forms track custody transfers, not technical write prevention.
Write Blocker
A hardware or software tool that prevents any write operations to a storage device during forensic acquisition, preserving evidence integrity.
- Allows read-only access to original media
- Essential for maintaining evidentiary integrity
- Used before imaging a drive
Memory trick: A write blocker is a one-way mirror: you can look in, but nothing can get out or change.