← Back to Tools & concepts

What a Write-Blocker Does

A write-blocker has exactly one job: guarantee that a drive connected through it can be read from, but nothing — not the operating system, not a careless click, not a background process — can write to it.

Why this is harder than it sounds

Modern operating systems write to a connected drive far more than most people realize, even when nobody's actively saving a file to it. Just plugging a drive in and browsing its contents in a file manager can trigger writes: journal updates, access-time stamps, thumbnail caches, automatic indexing, or an OS silently offering to "repair" a drive it thinks looks unhealthy. On a drive that's the only copy of important data — especially one that's already degrading — any one of these routine, invisible writes can overwrite exactly the data you're trying to recover.

A write-blocker sits between the source drive and the computer, and physically or logically intercepts every write command before it reaches the drive, letting only read commands through. The connected computer can look at everything on the drive, but can't change any of it.

Hardware vs. software write-blockers

• Hardware write-blockers are physical devices the drive connects through — the drive plugs into the blocker, and the blocker plugs into the computer. They intercept write commands at the electrical/protocol level, independent of whatever operating system or software is running on the computer. This is the more trusted approach precisely because it doesn't depend on any software behaving correctly.
• Software write-blockers are drivers or utilities that intercept write commands at the operating-system level instead. They're more convenient and don't require dedicated hardware, but depend on the OS and driver stack working exactly as intended — a weaker guarantee than a hardware blocker sitting physically in between.

When this actually matters

Outside of formal forensic work — where a write-blocker is often a strict procedural requirement to preserve evidence — the same principle applies to ordinary recovery any time a drive is:

• Physically degrading, where every additional read carries some risk and a write could actively destroy data (see Software vs. Hardware Recovery).
• The only copy of something that matters, where there's no room for a mistake to be undone.
• Being imaged for analysis before any recovery attempt — standard professional practice is to create a full disk image first and work from the copy, never the original, which is itself a form of write protection.