Definitions

A write-blocker is

“

[a] device that allows investigators to examine media while preventing data writes from occurring on the subject media.[1]

”

“

[a] device that allows the acquisition of information on a drive without creating the possibility of accidentally damaging the drive.[2]

”

Overview

Hardware write-blockers are physically connected to the computer and the storage media being processed to prevent any writes to that media.

This allows forensic analysts to examine a suspect's computer hard drives or other digital media without altering data on that media to ensure that data are not added to the suspect’s storage media.

References