In forensic workflows, what is the main purpose of a write-blocker?

• A. Encrypts the data during transfer
• B. Improves read speed
• C. Prevents any changes to the original media during collection
• D. Allows rapid imaging by caching writes

Answer: (C)

Preserving the original evidence integrity during data collection is essential. A write-blocker sits between the evidence media and the imaging workstation and allows read access while blocking any write commands. This ensures you can create a precise, unaltered copy of the data without risking any modification to the source drive, which is crucial for maintaining the forensic chain of custody and admissibility. Encrypting data during transfer protects confidentiality, not the integrity of the original media. Improving read speed or caching writes does not prevent changes to the source and could compromise the evidence.