When examining digital evidence on a device, what is used to prevent data from being copied back to the evidence item inadvertently?
A) write blocker
B) live acquisitions
C) deduplication
D) forensic imaging

Question

Quizplus · Accepted Answer

A write blocker is a hardware device or software program that prevents any write operation on the device, thereby ensuring that the data on the evidence item cannot be modified or copied back to the device inadvertently. Live acquisitions, deduplication, and forensic imaging do not provide the same level of protection against inadvertent copying or modification of data on the evidence item.

When Examining Digital Evidence on a Device, What Is Used