In digital forensics, which artifact is used to verify a forensic image has not been altered?

In digital forensics, which artifact is used to verify a forensic image has not been altered?

• A. Hash sets
• B. Bookmarks
• C. Keywords
• D. File signatures

Answer: (A)

Verifying the integrity of a forensic image relies on cryptographic hash values. When you acquire an image, you compute a hash (such as SHA-256) and record it in a hash set or manifest. This hash acts as a fingerprint of the exact bitstream. Later, you recompute the hash and compare it to the original; a match means the image has not been altered, while a mismatch indicates tampering or corruption. This approach is essential for a verifiable chain of custody. Bookmarks are just navigational markers, keywords are search terms, and file signatures identify file types—not whether the image has remained unchanged.

Verifying the integrity of a forensic image relies on cryptographic hash values. When you acquire an image, you compute a hash (such as SHA-256) and record it in a hash set or manifest. This hash acts as a fingerprint of the exact bitstream. Later, you recompute the hash and compare it to the original; a match means the image has not been altered, while a mismatch indicates tampering or corruption. This approach is essential for a verifiable chain of custody. Bookmarks are just navigational markers, keywords are search terms, and file signatures identify file types—not whether the image has remained unchanged.