When conducting a forensic investigation, what is the PRIMARY reason an investigator should use a write blocker when accessing a suspect drive?
-
A
To speed up the data acquisition process
-
B
To prevent accidental modification of the original evidence
-
C
To compress the forensic image for storage
-
D
To decrypt encrypted partitions automatically