What is a write blocker?
A write blocker is a device or software control that allows read access to a storage device and refuses every attempt to write to it. Investigators attach a suspect drive through one before they image or examine it, so the act of looking at the evidence doesn't change it. Without one, simply connecting a drive to a workstation can alter it: the operating system may update access timestamps, replay a file system journal, create hidden system folders or try to repair what it thinks is damage. Any of those changes alters the drive's hash and gives the other side in a dispute a reason to question everything found on it.
Hardware and software write blockers
A hardware write blocker, sometimes called a forensic bridge, sits physically between the suspect drive and the forensic workstation. It has a port for the evidence drive, such as SATA, SAS, USB or NVMe depending on the model, and a connection to the workstation. It passes read commands through, stops write commands, and usually shows a light or display confirming the drive is protected. Because it works below the operating system, a misconfigured or compromised workstation can't override it, which is why hardware blockers are preferred for evidence that may end up in court.
A software write blocker enforces read-only access in the operating system or the forensic tool. Examples include a Windows setting that makes USB storage read-only and Linux forensic distributions that attach new disks read-only by default. They are cheaper and convenient in the field, but they depend on the host behaving correctly. Mounting a Linux ext4 file system with the ro option, for instance, can still replay its journal and write to the disk unless journal loading is also disabled with the noload option.
Solid-state drives add a caveat: some keep running internal garbage collection whenever they have power, so data on a write-blocked SSD can still change, and two hashes taken some time apart may not match. Investigators document this rather than treating it as tampering.
Proving the blocker works
A write blocker is only useful if it really blocks writes, so labs test them. NIST's Computer Forensics Tool Testing (CFTT) program publishes test results for hardware and software write blockers, and many labs run their own check: hash a test drive, attach it through the blocker, attempt writes, then hash it again. The blocker's model, firmware version and serial number go into the case notes next to the acquisition hashes.
Example: acquiring a laptop drive
- Photograph the laptop, record its serial number and remove the drive.
- Connect the drive to the hardware write blocker, then connect the blocker to the forensic workstation and power it on.
- Confirm the blocker reports the drive as write-protected and the workstation sees it as read-only.
- Hash the source drive with SHA-256, image it to a separate, wiped evidence drive and hash the image.
- Record both hashes, the blocker details and the time in the case notes and chain of custody form.
If the hashes match, the image is a faithful copy and the original was never written to.
Write blocker vs. related controls
- Hashing proves after the fact that evidence hasn't changed. A write blocker prevents the change in the first place. Investigators use both.
- A write-protect switch, such as the tab on an SD card, is only a signal the host may or may not honor, so it isn't a forensic control.
- Chain of custody documents who handled the evidence and when; it says nothing about whether the data was altered.
- Memory capture doesn't involve a write blocker at all, because RAM is collected from a running system with a capture tool.
Write blocker on the CompTIA Security+ exam
Write blockers support two SY0-801 objectives: preserving evidence during the investigation phase of incident response (objective 4.7) and protecting integrity when system images are acquired (objective 4.8). The scenario wording to watch for is a requirement that the original drive must not be modified while it is copied or examined; that points to a write blocker. Hashing is the usual distractor, because it proves integrity but doesn't prevent writes. Chain of custody, legal hold and order of volatility are other near misses that solve different problems.