In static acquisitions, this automatic access corrupts the integrity of evidence. When acquiring
data with Windows, you must use a write-blocking device or Registry utility. With a correctly
configured Linux OS, such as a forensic Linux Live CD, media aren’t accessed automatically,
which eliminates the need for a write-blocker. If you need to acquire a USB drive
that doesn’t have a write-lock switch, use one of the forensic Linux Live CDs (discussed in
the next section) to access the device.