Glossary
Write Blocker
A hardware or software control that prevents any writes to evidence media during acquisition, preserving its integrity.
A write blocker is a device or piece of software that sits between the investigator's workstation and the evidence media, allowing data to be read but blocking any write or modification. Simply connecting a disk to a running computer can change timestamps or mount metadata, so a write blocker ensures the original is acquired exactly as it was found.
Hardware write blockers are physical bridges (for example USB, SATA, or NVMe interfaces) that intercept and reject write commands at the bus level; they are widely trusted because they cannot be bypassed by the host operating system. Software write blockers instead use the operating system to mark a device read-only, which is more flexible but depends on correct configuration.
Using a write blocker is a cornerstone of sound acquisition: it preserves the integrity of the evidence and supports the hashes recorded for the chain of custody.