In digital forensics, a write blocker is a critical tool used to prevent any modifications to the source drive during imaging. When a forensic image is created, it should be an exact bit-for-bit copy of the original evidence. If a write blocker is not used, system processes or other unintended changes can alter the contents of the drive, leading to a hash mismatch between the original and the image copy.
* Chain of custody (Option A)ensures proper documentation of who accessed the evidence, but it does not directly affect the hash values.
* Legal authorization (Option B)is necessary but unrelated to the technical integrity of the image.
* Data integrity verification (Option C)is part of the process, but in this scenario, the failure to maintain integrity stems from the lack of a write blocker.
Thus, the correct answer isD, as using a write blocker would have prevented any unintended changes to the data.