What practice helps verify the integrity of a forensic image?

What practice helps verify the integrity of a forensic image?

• A. Compare hash values
• B. Visual inspection
• C. Random sampling
• D. Not verifying anything

Answer: (A)

Verifying the integrity of a forensic image relies on comparing cryptographic hash values. When you create the image, you compute a hash (such as SHA-256) of the entire data and securely store that fingerprint. After you have the image, you recompute the hash and compare it to the original. If they match, the copy is an exact bit-for-bit replica and nothing has changed since imaging, which is essential for maintaining the chain of custody and ensuring admissibility. Visual inspection can’t reveal hidden modifications, and random sampling might miss tampering because it doesn’t test every bit. That’s why hash comparison is the reliable method to verify integrity.

Verifying the integrity of a forensic image relies on comparing cryptographic hash values. When you create the image, you compute a hash (such as SHA-256) of the entire data and securely store that fingerprint. After you have the image, you recompute the hash and compare it to the original. If they match, the copy is an exact bit-for-bit replica and nothing has changed since imaging, which is essential for maintaining the chain of custody and ensuring admissibility. Visual inspection can’t reveal hidden modifications, and random sampling might miss tampering because it doesn’t test every bit. That’s why hash comparison is the reliable method to verify integrity.