IMHO it's good to do both. Just don't rely on them as your only defense. The blacklist will help filter out some problems. The whitelist will improve quality of what remains. After the 2 filters have done their job you have a slightly less murky mess left to deal with. Run scans on what is left to clean it up a bit. What is left will still not necessarily be trustworthy but it won't be raw sewage anymore if you had good whitelist/blacklist/anti-malware. Copy what's left to media and transfer it to an airgapped machine to work with so you don't contaminate the original machine when you open it up.