Which of the following best describes the use of write-blockers in handling digital evidence?

• A. To speed data copying.
• B. To grant broad access to investigators.
• C. To bypass chain of custody requirements.
• D. To prevent any modification to original data while preserving evidence integrity.

Answer: (D)

Preventing any modification to original data while preserving evidence integrity is what write-blockers do. In digital forensics, investigators often need to create exact copies of storage devices. A write-blocker sits between the device and the analysis workstation, presenting the device as read-only so no write commands can reach the drive. This keeps the original evidence untouched, allowing forensic hashing to verify that the data hasn’t changed during imaging and examination. By preserving the original state, the chain of custody is maintained and the evidence remains admissible. Write-blockers don’t speed up copying, don’t grant broader access, and don’t bypass custody controls; they protect the data by preventing any modification.