Write Blocker
A hardware or software layer used during forensic acquisition to prevent write operations from modifying the source storage device.
A write blocker is a hardware or software layer used in digital forensics to prevent writes to source storage media during acquisition or examination.
Purpose
A write blocker attempts to stop write commands from reaching source media during acquisition or examination. This reduces the risk that the operating system or analysis tooling will modify source metadata or content.
Hardware and Software
A hardware blocker sits in the physical storage path. Software approaches rely on operating-system and driver behavior.
In either case, simply stating that a blocker is present is not a substitute for validation. The acquisition procedure should verify the expected write-protection behavior.
Evidence Handling
Write protection is only one part of Chain of Custody. Source identity, hashes, acquisition time, tool versions and operator actions still need documentation.