If a hardware blocker cannot be acquired could an investigator use DD without a write blocker, would that be forensically sound?
The most important part of the forensic investigation is to prove beyond a doubt the integrity of your evidence.
A good way to do this is to compare the hash of the acquired disk image against the hash of the original disk which should have been taken when the disk is recovered from the crime scene. Said hash should most probably be on the chain of custody form.
If a hardware write blocker cannot be used, I would suggest booting the system in question into a live Linux CD that mounts the disk in read-only mode. A forensics live CD like Helix can do this automatically.
Instead of using the standard