Among Digital Forensics Equipment, which item prevents modifying evidence on a storage device?

• A. Hardware Write-Blockers
• B. Forensics Laptop/Workstation
• C. Electro-Static Evidence Bags With Tamper-Proof Stickers
• D. Photographs

Answer: (A)

Blocking write commands at the hardware level is what ensures evidence on a storage device cannot be modified during collection. A hardware write-blocker sits between the evidence drive and the workstation and only allows read operations, so any attempt by the system to write to the source drive is prevented. This guarantees the original data stays exactly as it was, which is essential for producing a reliable forensic image and for verifying integrity with hashes later on.

In practice, this is the cornerstone of preserving evidence: you can read and image the drive without risking accidental or intentional alteration. The other items play important roles in the process—protecting custody, documenting the scene, or aiding analysis—but they do not stop writes to the device itself, which is why the hardware write-blocker is the best choice for preventing modification.