When using Windows acquisitions tools to acquire digital evidence, it is important to use a well- tested hardware write-blocking device to _________

The correct answer is D. Prevent contamination to the evidence drive. A hardware write-blocking device prevents any data from being written to the evidence drive during acquisition. Without it, the acquisition tool or operating system (Windows in particular) may inadvertently write timestamps, swap data, or other artifacts to the original drive…

Submitted by yaw92· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

AAutomate collection from image files
BAvoiding copying data from the boot partition
CAcquire data from the host-protected area on a disk
DPrevent contamination to the evidence drive

How the community answered

(32 responses)

A
6% (2)
B
3% (1)
C
3% (1)
D
88% (28)

Explanation

A hardware write-blocking device prevents any data from being written to the evidence drive during acquisition. Without it, the acquisition tool or operating system (Windows in particular) may inadvertently write timestamps, swap data, or other artifacts to the original drive, thereby contaminating the evidence and compromising its forensic integrity. Write blockers ensure that the original drive remains unchanged, which is essential for maintaining the admissibility and authenticity of the evidence in legal proceedings.

Topics

#Hardware write-blocker#Digital evidence acquisition#Evidence integrity#Contamination prevention

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice