The correct option is Forensic write blocker.

A Forensic write blocker is a hardware or software tool that allows read only access to a storage device while preventing any writes to that media. It preserves the original data and its metadata so the evidence remains forensically sound and admissible.

Investigators attach a Forensic write blocker when collecting disks to stop the operating system or analysis tools from changing timestamps or other information. This preserves chain of custody and supports later verification with hashing.

Hashing utility is used to compute checksums for verifying integrity, but it does not prevent data from being altered during collection. Hashing is used to prove that data has not changed after acquisition, not to block writes while collecting.

Debugging tool is intended for troubleshooting software and inspecting program behavior, and it has no role in preventing writes to storage media during evidence collection.

Drive cloning utility can create a copy of a drive, but cloning alone does not guarantee the original will not be written to. Cloning processes should be performed with a Forensic write blocker attached to ensure the source remains unchanged.

Full AWS Practitioner Certification Question