A write-blocker is a specialized forensic device, either hardware or software-based, that prevents any write operations from reaching a storage device connected for analysis. It allows an examiner to access and copy data from an evidence disk in a read-only mode. This is a critical step in digital forensics to ensure that the original evidence is not altered in any way, thereby preserving its integrity and admissibility in legal proceedings. The write-blocker sits between the evidence disk and the forensic workstation, intercepting and blocking all write commands sent by the operating system or other software.

B. a protocol analyzer: This tool is used to capture and analyze network traffic, not to manage disk I/O operations or prevent data writes.

C. a firewall: A firewall is a network security device that monitors and controls network traffic based on security rules; it does not interact with disk write permissions.

D. a disk editor: This tool is used to view and manually modify the raw data on a disk, which is the opposite of preventing data from being recorded.

1. National Institute of Standards and Technology (NIST). (2004). Hardware Write Blocker (HWB) Device Test Specification, Version 1.1. Computer Forensics Tool Testing Program (CFTT). Section 2, "Introduction," defines a hardware write blocker as a device that "shall not transmit any command to the protected storage device that would modify the data on the storage device."

2. Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional. Chapter 3, "Data Acquisition," discusses the necessity of write-blockers, stating, "To prevent data from being modified, a write-blocker is used. A write-blocker is a device or software that allows read requests to be sent to a storage device but prevents write requests."

3. George Mason University. (n.d.). CFRS 660: Computer Forensics I, Lecture 3: Acquiring Digital Evidence. Courseware. The lecture notes specify that write-blockers are essential tools that "prevent any writes to a drive" during the evidence acquisition phase to maintain forensic soundness.