CHFI Computer Forensics Fundamentals and Process Practice Question
During a forensic investigation, an analyst uses a tool to create a bit-for-bit copy of a hard drive while ensuring the original is not modified. Which of the following is a hardware write blocker that can be used for this purpose?
⚠ Common exam trap
The CHFI exam often tests the distinction between software tools (FTK Imager, dd, EnCase) and dedicated hardware write blockers (Tableau), trapping candidates who assume any forensic imaging tool inherently provides write protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tableau
A hardware write blocker physically prevents any write commands from reaching the original drive at the SATA/IDE bus level, ensuring the drive remains unaltered during acquisition. Tableau is a well-known manufacturer of forensic hardware write blockers that operate transparently to the imaging software, making it the correct choice for a hardware-based solution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FTK Imager
Why it's wrong here
FTK Imager is a software-only forensic acquisition and preview tool. It does not contain any hardware write-blocking circuitry, so while it may appear to open a drive in a read-only mode, that safety depends entirely on operating system drivers and can be bypassed or fail if the drive is auto-mounted or if the OS issues maintenance writes. Without a separate hardware write blocker, imaging with FTK Imager can alter the source medium, invalidating forensic soundness.
- ✓
Tableau
Why this is correct
Tableau is a manufacturer of dedicated hardware write blockers, not just imaging software. A Tableau device sits between the suspect drive and the forensic workstation, intercepting ATA/SCSI commands at the hardware level and physically gating any write command from reaching the storage medium. This hardware-level enforcement is exactly what forensic investigators need to guarantee that the original evidence remains unaltered, making Tableau the correct answer.
- ✗
dd
Why it's wrong here
dd is a low-level Unix/Linux command-line tool that simply copies data from one location to another. It has no built-in write-blocking capability whatsoever; it issues read operations to the source and write operations to the destination image file. If the source drive is not write-protected by external hardware, the OS can still perform background writes such as filesystem journal updates or atime changes during the dd process, so using dd alone can contaminate evidence.
- ✗
EnCase
Why it's wrong here
EnCase is a comprehensive forensic software suite that performs acquisition, analysis, and reporting, but it is not a write-blocking device. Although EnCase may have a software write-block feature when the operating system supports it, that feature relies on drivers and can be compromised, which is why standard forensic practice requires pairing EnCase with an external hardware write blocker. EnCase by itself is insufficient to protect the source drive, so it is not the correct answer.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.