CHFI Computer Forensics Investigation Process Practice Question
A CHFI analyst is preparing a forensic workstation to image a suspect's USB flash drive. The analyst needs to ensure that the write-blocker is functioning correctly before connecting the drive. Which of the following is the most appropriate method to verify that the write-blocker is preventing write operations?
⚠ Common exam trap
The trap here is assuming that LED indicators or software write-blockers provide sufficient assurance without functional testing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Connect the write-blocker to the forensic workstation, then use a known clean USB drive and attempt to write a file to it; if the write fails, the write-blocker is working.
The correct method is to test the write-blocker with a known clean drive by attempting a write operation. If the write is blocked, the write-blocker is functioning. This ensures the suspect's drive remains unaltered. Other methods either rely on indicators, which are insufficient, or risk contaminating evidence. Proper validation is a key step in the forensic process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Connect the suspect's USB drive directly to the forensic workstation and attempt to write a test file; if the write succeeds, the write-blocker is not needed.
Why it's wrong here
Connecting the suspect's drive directly violates forensic principles by potentially altering evidence. Writing a test file to the suspect's drive would modify the evidence and could destroy data. The write-blocker is essential to prevent such modifications. This method is unsafe and unprofessional.
- ✓
Connect the write-blocker to the forensic workstation, then use a known clean USB drive and attempt to write a file to it; if the write fails, the write-blocker is working.
Why this is correct
This method directly tests the write-blocker's function by attempting a write operation to a known clean drive. If the write is blocked, it confirms the write-blocker is operational. It is safe because the drive is not evidence, and the test does not alter the original evidence. This is a standard validation procedure recommended in forensics.
- ✗
Use a software write-blocker on the forensic workstation instead of a hardware write-blocker, as software blockers are more reliable and do not require validation.
Why it's wrong here
Software write-blockers can be less reliable than hardware ones and may be bypassed by certain operations. The scenario already involves a hardware write-blocker, and the analyst needs to verify it. Switching to software does not address the verification need and could introduce risk. Additionally, software blockers are not inherently more reliable.
- ✗
Check the write-blocker's LED indicators; if the power light is on and the read/write switch is set to read-only, the write-blocker is functioning correctly.
Why it's wrong here
LED indicators only show power and switch position, not actual write-blocking behavior. A faulty write-blocker could still show correct lights. Relying solely on indicators does not confirm that writes are physically blocked. The analyst must perform a functional test to ensure integrity of the evidence.
Go deeper
Related to this question
Learn chapter
Forensic Investigation Process and Methodology
Key term
Disk Imaging
Disk imaging is the process of creating an exact, bit-for-bit copy of a storage drive, preserving all data, deleted files, and unallocated space for forensic analysis or system recovery.
Key term
Memory Acquisition
Memory acquisition is the process of capturing the contents of a computer's volatile memory to preserve data for forensic analysis and incident response.
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.