Computer Hacking Forensic Investigator (CHFI v10) — Question 553

An investigator needs to perform data acquisition from a storage media without altering its contents to maintain the integrity of the content. The approach adopted by the investigator relies upon the capacity of enabling read-only access to the storage media. Which tool should the investigator integrate into his/her procedures to accomplish this task?

Answer options

• A. Data duplication tool
• B. BitLocker
• C. Write blocker
• D. Backup tool

Correct answer: C

Explanation

The correct answer is C, Write blocker, as it is specifically designed to allow read-only access to storage media while preventing any modifications to the data. Options A and D do not restrict write access, and B, BitLocker, is an encryption tool that does not serve the purpose of preventing data alteration.