CHFI Computer Forensics Fundamentals and Process Practice Question
During a forensic investigation, an analyst acquires a hard drive using a hardware write blocker. Which of the following is the PRIMARY reason for using a hardware write blocker?
⚠ Common exam trap
It's easy for candidates to confuse the write blocker's purpose with performance features (speed, compression) or assume it can bypass security mechanisms, when in fact its sole forensic function is to guarantee read-only access at the hardware interface level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To ensure that the operating system does not mount the drive as writable.
The primary reason for using a hardware write blocker is to physically intercept the SATA/IDE bus between the suspect drive and the forensic workstation, ensuring that only read commands (e.g., ATA READ DMA) are passed through while blocking any write commands (e.g., ATA WRITE DMA). This prevents the operating system from mounting the drive as writable, which would otherwise cause automatic writes (e.g., timestamp updates, journaling, or prefetch creation) that alter evidence and break the chain of custody.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To increase the transfer speed of the imaging process.
Why it's wrong here
Write blockers are command-pass-through devices that operate at the ATA/SCSI interface layer; they do not alter the electrical characteristics of the bus or magically increase throughput. In fact, because they intercept and inspect every command, they add a small amount of processing latency, so transfer speed is typically slightly lower than a direct connection. The speed of an imaging process is determined by the drive's internal read rate, the interface bandwidth, and the capabilities of the forensic imaging software. Write blockers exist solely to preserve data integrity, not to accelerate any part of the acquisition workflow.
- ✗
To bypass the drive's password protection.
Why it's wrong here
Drive password protection is implemented in the drive's firmware, not at the interface level, and requires the correct password to be passed to the drive via a SECURITY UNLOCK command. A write blocker is a passive filter that only manages whether commands are allowed to reach the drive; it has no mechanism to know, supply, or bypass the password. If the analyst already has the password, the write blocker will simply pass the unlock command through, but without the correct password, the drive will remain locked and no forensic imaging can occur. Bypassing such protection requires specialized forensic techniques such as vendor-specific backdoor commands, direct chip-off access, or brute-force/hardware tools, none of which are functions of a write blocker.
- ✗
To compress the data during imaging.
Why it's wrong here
Data compression during imaging is a function of the forensic imaging software (e.g., EnCase, FTK Imager) that reads the data stream and compresses it on the fly or after acquisition. A write blocker does not manipulate, transform, or in any way alter the data passing through it; it only allows read commands from the host to reach the drive and blocks write commands. Implementing compression within a write blocker would require buffering and processing the data at the hardware level, which would change the data stream and potentially violate the forensic principle of acquiring a bit-for-bit image. The write blocker's sole purpose is to ensure that the original drive is not modified, not to enhance the image format or reduce storage requirements.
- ✓
To ensure that the operating system does not mount the drive as writable.
Why this is correct
The forensic purpose of a write blocker is to prevent the host operating system from mounting the evidence drive with write access. Without a write blocker, merely connecting a drive to a forensic workstation can cause the OS to automatically mount it read-write, creating files, updating last-accessed timestamps, or writing to the filesystem journal—all of which modify the evidence and invalidate its cryptographic hash. A hardware write blocker sits between the drive and the host and intercepts ATA/SCSI commands, allowing read commands to pass while blocking write commands at the firmware level. This guarantees that the original evidence drive remains bit-for-bit unchanged, preserving its forensic integrity and admissibility in court.
Go deeper
Related to this question
Learn chapter
Overview of Computer Forensics and Investigation Process
Key term
Chain of custody
Chain of custody is a documented process that tracks the handling, transfer, and possession of evidence or digital assets from the moment they are collected until they are presented in court or used in an investigation.
Key term
Evidence Admissibility
Evidence admissibility is the legal and technical standard that determines whether digital evidence can be used in a court of law.
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.