CHFI Evidence Acquisition and Duplication Practice Question

Which of the following is the primary purpose of using a hardware write blocker during disk acquisition?

⚠ Common exam trap

EC-Council often tests the misconception that a write blocker performs active functions like decryption or compression, when in reality it is a passive hardware filter that only enforces read-only access at the bus level.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

To prevent any writes to the original evidence drive

A hardware write blocker is a device placed between the suspect drive and the forensic workstation that intercepts and blocks any write commands from the host operating system, ensuring that the original evidence drive remains unaltered. This is critical for maintaining the integrity of digital evidence, as any modification to the source drive could render it inadmissible in court. The primary purpose is therefore to prevent any writes to the original evidence drive, preserving its exact state for forensic analysis.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
To decrypt the drive during acquisition
Why it's wrong here
A write blocker is a hardware or software mechanism that filters commands at the ATA/SCSI or NVMe level, rejecting any that would modify the storage medium. It does not perform cryptographic operations; decryption requires a separate key and tool, and attempting to decrypt during acquisition would inherently involve reading and potentially writing decrypted data back, which a write blocker would not allow. Therefore, decrypting the drive is outside the write blocker's function and scope.
✓
To prevent any writes to the original evidence drive
Why this is correct
The primary purpose of a write blocker is to guarantee the integrity of the original evidence by creating a read-only interface between the drive and the forensic workstation. It intercepts and blocks all write commands issued by the operating system, including those that might occur from normal mounting, file system metadata updates, or malware, ensuring the source drive remains bit-for-bit unchanged. This preservation is essential for maintaining a legally defensible chain of custody and allowing a subsequent hash verification to prove evidence authenticity.
✗
To compress the acquired image
Why it's wrong here
Write blockers are not designed to compress data; they simply pass read commands through while blocking write commands, without altering the data stream. Compression in forensic imaging is performed by software such as FTK Imager or dd with a compression algorithm, which creates formats like E01 or AFF. Even if a write blocker had compression capabilities, it would risk modifying the raw data and breaking the exact-for-forensic-copy standard, so it is not a function of the device.
✗
To increase the speed of the acquisition
Why it's wrong here
A write blocker does not increase acquisition speed; it is a passive component that may introduce slight delays due to protocol conversion or logic circuitry. The transfer rate is governed by the original drive's read speed, the acquisition interface (e.g., SATA, USB, NVMe), and the imaging software, not by the blocker itself. In some cases, a poorly designed write blocker can even bottleneck throughput, making speeds slower than a direct connection.

Go deeper

CHFI Evidence Acquisition and Duplication Practice Question

Why each option matters

Option-by-option breakdown

Related to this question