PHASE: Write Blockers33% COMPLETION
MODULE 02
Evidence Acquisition (Imaging)
Creating bit-for-bit copies using FTK Imager, dd, and hardware write blockers.
Write Blockers
A write blocker is a hardware or software tool that prevents ANY modification to the source drive during acquisition.
Critical Rule
If you connect a suspect drive to a Windows machine without a write blocker, Windows will automatically write to it (timestamps, Recycle Bin, etc.), contaminating evidence.