To verify the integrity of evidence during processing, which practice is recommended?

To verify the integrity of evidence during processing, which practice is recommended?

• A. Encrypting the evidence with a password
• B. Computing a cryptographic hash before and after examination
• C. Uploading to cloud storage
• D. Deleting the original after copy

Answer: (B)

Maintaining evidence integrity during processing hinges on being able to prove the data hasn’t changed. Computing a cryptographic hash of the evidence before you start examining it and then again after you’re finished creates a tamper-evident check. The hash acts as a fingerprint of the entire data: if any bit of the data is altered, the hash value will change. By comparing the pre-processing hash to the post-processing hash, you can confirm that the evidence remains identical, which supports admissibility, repeatability, and a solid chain of custody. Encrypting the evidence with a password only hides its contents and doesn’t reveal or confirm whether the data has been modified. Uploading to cloud storage might be convenient, but without hash verification, you have no reliable way to detect alterations or ensure integrity during transfer and storage. Deleting the original after creating a copy destroys a point of comparison and undermines the ability to verify authenticity later. So, the best practice is to compute a cryptographic hash before and after examination to verify that the evidence remains unchanged throughout processing.

Maintaining evidence integrity during processing hinges on being able to prove the data hasn’t changed. Computing a cryptographic hash of the evidence before you start examining it and then again after you’re finished creates a tamper-evident check. The hash acts as a fingerprint of the entire data: if any bit of the data is altered, the hash value will change. By comparing the pre-processing hash to the post-processing hash, you can confirm that the evidence remains identical, which supports admissibility, repeatability, and a solid chain of custody.

Encrypting the evidence with a password only hides its contents and doesn’t reveal or confirm whether the data has been modified. Uploading to cloud storage might be convenient, but without hash verification, you have no reliable way to detect alterations or ensure integrity during transfer and storage. Deleting the original after creating a copy destroys a point of comparison and undermines the ability to verify authenticity later.

So, the best practice is to compute a cryptographic hash before and after examination to verify that the evidence remains unchanged throughout processing.