312-49 · Question #181
When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?
The correct answer is A. Write-blocker. A write-blocker (hardware or software) is a device that allows read access to a storage medium while preventing any write operations. When connected between the forensic workstation and the evidence drive, it ensures that the examination process does not inadvertently alter…
Question
When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?
Options
- AWrite-blocker
- BProtocol analyzer
- CFirewall
- DDisk editor
How the community answered
(66 responses)- A91% (60)
- B2% (1)
- C6% (4)
- D2% (1)
Explanation
A write-blocker (hardware or software) is a device that allows read access to a storage medium while preventing any write operations. When connected between the forensic workstation and the evidence drive, it ensures that the examination process does not inadvertently alter, add, or delete any data on the original evidence - which is critical for maintaining forensic integrity and chain of custody. A protocol analyzer captures network traffic, a firewall filters network access, and a disk editor is a tool for viewing/editing disk content, none of which prevent writes to evidence media.
Topics
Community Discussion
No community discussion yet for this question.