An Analysis of Forensic Imaging in the Absence of Write-Blockers

<p>Best practices in digital forensics demand use of write-blockers when creating forensic copies of digital media and this has been a core of computer forensics training for decades. The practice is so in-grained that images created without a write-blocker are immediate suspect for integrity. This paper describes a research framework to examine what occurs when a forensic image is acquired without benefit of a write-blocker in order to understand the true impact of such an eventuality. The initial tests document the changes made to a hard drive and flash drive when imaged and examined with a Windows-based forensics workstation.