Plug a hard drive or USB stick into a normal computer and the operating system starts writing to it almost straight away. It can update access times, add hidden index files or try to "repair" a file system it does not like. On your own drives that is harmless. On evidence it is a problem, because the drive you hand back is no longer the drive you were given. A write blocker is the tool that stops that happening.
What a write blocker does
A write blocker sits between the evidence drive and your examination computer. Read requests go through so you can browse, examine and image the drive. Write requests are stopped before they reach it. The source stays exactly as it was, and you can show that it did.
A write-protected hub or dock does the same job for several connection types at once. Instead of one cable for one drive, you get a single unit with the connectors for SATA, IDE and other drive types, and the write protection built into the hardware.
Hardware or software blocking
Software write blocking uses settings or a driver on the examination computer to stop writes to attached storage. It costs little and can be handy in a pinch. The weakness is that it depends on that computer's configuration. An update, a different machine or a mistake with a setting can undo it, and it is harder to show anyone else that it was working.
Hardware write blockers do the blocking in the device itself, so it works the same way whatever computer it is plugged into. Most also show their state with LEDs or a screen, so you can see at a glance that write blocking is on. That is why hardware blockers are the normal choice in forensic labs. CRU also supplies a free WriteBlocking Validation Utility for Windows with its USB WriteBlocker, which lets you test that the blocking is doing its job and keep a record of it.
When to use one
Any time you are examining or imaging storage that might end up as evidence. That covers hard drives and SATA SSDs pulled from laptops and desktops, NVMe SSDs from newer machines, and USB sticks, external drives and memory cards.
It also matters before you image. Even a quick look at a drive to see what is on it should be done through a blocker, because that first look is exactly when an operating system tends to write to it. Some docks will also warn you about hidden areas on a drive (HPA and DCO), which is worth knowing before you take your image.
The CRU WiebeTech range we sell
We stock a range of CRU WiebeTech forensic hardware. These are the ones that sell best.
The CRU WiebeTech USB WriteBlocker 3.1 is a small, bus powered blocker for USB storage. You connect it to a Windows host over USB, plug in the drive, and a status LED tells you when the drive is safe to inspect. It is our best seller in the range and easy to keep in a kit bag.
CRU WiebeTech USB WriteBlocker 3.1
For bare drives, the Forensic UltraDock FUDv6 gives write-blocked access to SATA and IDE drives over USB 3.2 Gen 2 Type-C. It comes as a complete kit with drive cables, USB cables and an AC adapter, has a two-line LCD, and has LEDs for write-block status and for HPA, DCO or AMA detection. With the right adapters it also handles mSATA, 1.8 inch drives and mini PCIe. The Forensic ComboDock FCDv6 supports the same drive types and has the same LCD and LED layout.
WiebeTech Forensic UltraDock FUDv6
NVMe drives need their own blocker. The WiebeTech NVMe WriteBlocker gives write-blocked access to M.2 (M key) and U.2 NVMe SSDs over USB 3.2 Gen 2 Type-C, and works with Windows, macOS and Linux hosts.
If you image in the field, the Ditto DX Forensic FieldStation is a standalone imager with source and destination ports for USB 3.0, eSATA and Gigabit Ethernet, so you can image from one source to two destinations without a separate computer.
The whole range, including adapters and cables, is in our CRU WiebeTech collection.
Where it fits
Write blockers deal with computers and loose storage. Phones are a different job, and our guide Mobile Forensics Hardware: From Seizure to Extraction covers the kit for those. Most labs need both. If you are not sure which blocker suits the drives you see, give us a ring and we will help you pick.