I think that you should offer both. If you know what you are doing, then make it so. If the user trusts you, they will let you write. If they do not trust you, they will write it themselves.

Passing the data (or references to it) around can cause more lines of code, more chances for error and confusion. Also, if your module is supposed to handle this data, then the user expects you will handle it. What would you think of tar if it only untarred the archive in memory and then gave you memory references? It would be less usefull.

Of course, you want to provide references to the data, so that the user could manipulate it before writing it to disk.

This is my humble opinion. Hope that it helps.