Glossary
Write blocker
A hardware or software device that lets an examiner read a storage device while preventing any command that could modify it.
A write blocker sits between evidence media and an examiner's computer and filters the storage protocol so that only read and identification commands reach the drive. Hardware write blockers are protocol bridges (SATA, SAS, USB, NVMe) independent of the host operating system; software write blockers rely on the OS to enforce read-only access.
Write blockers support the integrity of digital evidence, but they cannot stop an SSD's own controller from performing garbage collection once powered. Their reliability should be backed by test reports, such as those from the NIST Computer Forensics Tool Testing program, and by the lab's own validation.