What step verifies that digital evidence has not been altered since collection?

What step verifies that digital evidence has not been altered since collection?

• A. Re-imaging the drive
• B. Signing a statement
• C. Compute a cryptographic hash and compare to the original
• D. Deleting

Answer: (C)

Ensuring that digital evidence hasn’t changed since collection is done by verifying its integrity with a cryptographic hash and comparing it to the original value. A hash function takes the exact bit pattern of the evidence and produces a fixed-size digest. Because even a tiny modification to the data would produce a completely different digest, computing the hash again later and matching it against the original hash confirms nothing was altered. At the time of collection you generate and securely record the hash of the evidence. Later, you recompute the hash from the preserved copy (or from the original, if it’s still available) and compare. If the digests match, you have strong evidence that the data remained unchanged; if they differ, something was altered or corrupted. Other options don’t provide the same assurance. Re-imaging creates a copy but doesn’t verify that the original material stayed intact. Signing a statement documents the process but doesn’t prove data integrity. Deleting destroys evidence and is contrary to forensics. So, computing a cryptographic hash and comparing it to the original is the correct practice.

Ensuring that digital evidence hasn’t changed since collection is done by verifying its integrity with a cryptographic hash and comparing it to the original value. A hash function takes the exact bit pattern of the evidence and produces a fixed-size digest. Because even a tiny modification to the data would produce a completely different digest, computing the hash again later and matching it against the original hash confirms nothing was altered.

At the time of collection you generate and securely record the hash of the evidence. Later, you recompute the hash from the preserved copy (or from the original, if it’s still available) and compare. If the digests match, you have strong evidence that the data remained unchanged; if they differ, something was altered or corrupted.

Other options don’t provide the same assurance. Re-imaging creates a copy but doesn’t verify that the original material stayed intact. Signing a statement documents the process but doesn’t prove data integrity. Deleting destroys evidence and is contrary to forensics. So, computing a cryptographic hash and comparing it to the original is the correct practice.