Disk Forensics: should a "write blocker" be used before any disk imaging software is used?

Question

In terms of forensic disk imaging of a mechanical HDD, should a "write blocker" be used before the disk imaging process takes place?

Answer 1

Yes, because otherwise the system that you connect the disk to to performing the imaging might make changes to the contents of the disk, which would undermine the integrity of the image. This is especially important if you're using Windows (which likes to mount disks and do things automatically in the background).

Whether you use hardware or software write blocking will depend on your requirements and the circumstances (and potentially also your budget).