Glossary term
Write Blocker
A write blocker is a hardware or software device that prevents any write operation to a source storage device during forensic acquisition, ensuring the original evidence is not altered.
Write blockers are standard equipment for any computer forensic acquisition. The tool sits between the source storage device and the acquisition workstation, allowing reads but blocking writes. This guarantees that the source remains in its original state.
Hardware write blockers from Tableau, WiebeTech, and other vendors support a wide range of interfaces: SATA, IDE, USB, FireWire, NVMe. We maintain a kit of write blockers covering the common interfaces a forensic intake encounters.
Software write blockers exist for situations where hardware is impractical, but hardware is preferred for forensic-grade work because the protection is enforced at the controller level rather than the operating system level.
A documented use of a write blocker at acquisition is a standard methodology disclosure in any examiner report. Opposing counsel often probe this point at cross-examination.