CHFI Computer Forensics Fundamentals and Process Practice Question
An investigator needs to acquire data from a suspect's hard drive without altering any data. Which tool is MOST appropriate to ensure write-blocking at the hardware level?
⚠ Common exam trap
EC-Council often tests the misconception that a software write-blocker (like FTK Imager’s built-in blocker) provides the same level of protection as a hardware write-blocker, when in fact only hardware-level blocking can prevent all write operations—including those from the OS, BIOS, or malicious firmware—from reaching the drive.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tableau Forensic Bridge (hardware write-blocker)
A hardware write-blocker like the Tableau Forensic Bridge sits between the suspect drive and the forensic workstation at the physical layer, intercepting and blocking any write commands (e.g., ATA WRITE DMA, SCSI WRITE) before they reach the drive. This ensures that no data—including metadata, timestamps, or file system artifacts—is altered during acquisition, which is critical for maintaining evidentiary integrity. Software-based blockers can be bypassed by the OS or a malicious driver, making hardware-level blocking the gold standard in forensic acquisition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Tableau Forensic Bridge (hardware write-blocker)
Why this is correct
A Tableau Forensic Bridge is a dedicated hardware write-blocker physically interposed between the forensic workstation and the suspect drive; it intercepts and discards all write commands at the bus level (e.g., SATA, IDE, or USB) using its own firmware and logic, rather than relying on the operating system. This makes it impossible for the OS, forensic software, or malicious code to alter the evidence drive, because write operations are terminated at the hardware interface before reaching the storage medium. Hardware write-blocking is the forensic gold standard and is the most defensible method for maintaining a pristine image.
- ✗
FTK Imager (software write-blocker)
Why it's wrong here
FTK Imager's software write-blocker is a filter driver that sits in the OS I/O stack and intercepts write operations after they originate from the operating system, which means it can only block writes if the OS is already booted and the driver is loaded. If the suspect drive is connected before that filter interrupts, or if a lower-level ATA command bypasses the filesystem/driver stack, writes can reach the drive undetected; additionally, the filter driver itself and the host OS add a layer that may be attacked or misconfigured. This is why software-only write-blocking is not sufficient for forensic soundness when a hardware write-blocker is available.
- ✗
dd command with 'iflag=noatime'
Why it's wrong here
The dd command with 'iflag=noatime' is a read-based acquisition tool, but the flag only suppresses updates to the access-time (atime) attribute on filesystems; it does not stop the kernel, mounted filesystems, journal replay, or other processes from writing to the evidence device. Because dd relies on the OS to perform underlying read operations, it provides no barrier against writes at the device level, and if the source and destination arguments are swapped or an output path is wildcarded, dd itself can overwrite the evidence. In short, iflag=noatime is an optimization for avoiding atime-related metadata changes, not a write-blocking mechanism.
- ✗
EnCase software acquisition module
Why it's wrong here
EnCase's software acquisition module performs imaging through its own driver and can warn or block certain writes, but this is an application-level software control that loads only after the operating system has initialized and claimed the devices, leaving a window where the OS can write volume labels, mount metadata, or restore files. It also relies on the EnCase driver correctly interpreting all ATA/NVMe commands and can be bypassed by direct register-level I/O or by a drive that receives manufacturer-specific commands. For a defensible acquisition, hardware write-blocking should be used to stop writes at the physical interconnect; EnCase alone cannot guarantee bit-level integrity.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.