Glossary
Write blocker
Hardware or software that lets you read evidence media without writing to it, so acquisition does not alter the original and break the hash.
A write blocker sits between the examiner's machine and the suspect drive and
drops any write command the operating system tries to send. That matters because
just attaching a disk is not passive. Windows will touch recycle-bin metadata,
update last-access times, or drop a System Volume Information folder on a
volume it auto-mounts, and every one of those writes changes the media and its
hash.
Hardware blockers are a physical bridge and are the courtroom-safe default. Software blockers set the OS to read-only and are convenient but only as trustworthy as the OS honoring the setting.
Working from an image instead of live media sidesteps the problem entirely: nothing the tool does can write back to a file it opens read-only. The parser never writes to your image, and never uploads it. Verify its integrity before and after to prove it.