SSCP Incident Response and Recovery Practice Question
During a forensic investigation, an examiner creates a bit-for-bit copy of a hard drive using a write blocker. What is the purpose of using a write blocker?
⚠ Common exam trap
ISC2 often tests the misconception that write blockers are used for encryption or speed optimization, but the core purpose is strictly write prevention to preserve evidence integrity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To prevent modification of the original evidence
A write blocker is a hardware or software device that intercepts and blocks any write commands from the forensic workstation to the source drive, ensuring that the original evidence remains unaltered during acquisition. This is critical for maintaining the integrity and admissibility of digital evidence in legal proceedings, as any modification could compromise the chain of custody and forensic soundness.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
To prevent modification of the original evidence
Why this is correct
A write blocker intercepts write commands at the hardware or driver level, allowing the examiner to read the drive while blocking any modification. This preserves the original evidence's integrity so the bit-for-bit copy remains forensically sound and admissible.
- ✗
To encrypt the data during transfer
Why it's wrong here
A write blocker prevents any write reaching the source drive, preserving evidentiary integrity; it performs no encryption at all. It is tempting because the device sits inline on the transfer path, and encryption would be the correct control when data must be protected in transit across an untrusted network.
- ✗
To speed up the imaging process
Why it's wrong here
A write blocker intercepts and blocks write commands, which adds no throughput benefit and can slightly reduce transfer speed. It is tempting because imaging large drives is slow, and a hardware write blocker would be the right choice when the requirement is preventing modification, not accelerating the copy.
- ✗
To verify the hash of the original drive
Why it's wrong here
Hash verification is performed by the imaging or forensic tool comparing source and copy values; the write blocker's role is blocking writes, not computing hashes. It is tempting because both support evidential integrity, and hashing would be the correct answer if the question asked how a copy is proven identical.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.