The Journal of Digital Forensics, Security and Law has an excellent article A STUDY OF FORENSIC IMAGING IN THE
ABSENCE OF WRITE-BLOCKERS that analyses forensics capture both with and without write blockers. From the journal:
Best practices in digital forensics demand the use of write-blockers
when creating forensic images of digital media, and this has been a
core tenet of computer forensics training for decades. The practice is
so ingrained that the integrity of images created without a
write-blocker are immediately suspect.
Merely mounting a file system can cause read/writes. Many modern filesystems, from ext3/4 and xfs to NTFS, all have a journal that maintains metadata about the filesystem itself. If power is lost, incomplete shutdown, or a number of reasons, this journal is automatically read and written back to file structures across the drive to maintain consistency of the filesystem itself. This may happen during the mount process, whether or not the file-system is read-write.
For example, from the ext4 documentation the
ro mount option will...
Mount filesystem read only. Note that ext4 will replay the journal
(and thus write to the partition) even when mounted "read only". The
mount options "ro,noload" can be used to prevent writes to the
Although these driver level changes do not affect the content of files, it is a forensics standard to take cryptographic hashes of evidence upon collection in order to maintain a chain of custody. If one can show that the hash, ie sha256, of currently held evidence matches what was collected, then you can prove beyond reasonable doubt that the drive's data has not been modified during the analysis process.
Digital evidence can be cited as evidence in nearly every crime
category. Forensic investigators need to be absolutely certain that
the data they obtain as evidence has not been altered in any way
during the capture, analysis, and control. Attorneys, judges and
jurors need to feel confident that the information presented in a
computer crime case is legitimate. How can an investigator ensure for
certain that his or her evidence is accepted in court?
According to the National Institute of Standards and Technology
(NIST), the investigator follows a set of procedures designed to
prevent the execution of any program that might modify the disk
A write blocker is necessary, because if any bit changes for any reason—OS, driver-level, file-system level or below—then the hashes of the collected vs analysed system will no longer match, and the drive's admissibility as evidence may be questioned.
The write-blocker is thus both a technical control against the possibility of low-level changes, and a procedural control to provide assurance that no changes were made, regardless of user or software. By removing the possibility of changes, it supports hashes to be used to show that analysed evidence matches collected evidence, and prevents many potential evidence handling problems and questions.
The JDFSL article's analysis shows that without a write-blocker, changes were made to the drives they tested. However, on the contrary side - the individual data files hashes would still be intact, so arguments for the soundness of evidence collected without a write blocker exist, but are not considered best-industry-practice.