What technique used by Encase makes it virtually impossible to tamper with evidence once acquired?

What technique used by Encase makes it virtually impossible to tamper with evidence once acquired?

• A. MD5 hash
• B. Copy to three drives
• C. Encrypt files
• D. CRC

Answer: (D)

Hash-based integrity verification is what ensures evidence cannot be tampered with after capture. EnCase creates a cryptographic hash of the acquired data (such as MD5 or a stronger hash) and stores that fingerprint. Later, re-computing the hash and comparing it to the original fingerprint reveals any modification: even a single bit change produces a different hash, signaling tampering. CRC is only a simple error-check and isn’t cryptographically secure, so it can’t reliably prove immutability. Copying to multiple drives helps preserve data, and encryption protects confidentiality, but neither by itself guarantees that the data remains unchanged. Therefore, using a cryptographic hash like MD5 to fingerprint the evidence is the method that makes tampering detectable.

Hash-based integrity verification is what ensures evidence cannot be tampered with after capture. EnCase creates a cryptographic hash of the acquired data (such as MD5 or a stronger hash) and stores that fingerprint. Later, re-computing the hash and comparing it to the original fingerprint reveals any modification: even a single bit change produces a different hash, signaling tampering. CRC is only a simple error-check and isn’t cryptographically secure, so it can’t reliably prove immutability. Copying to multiple drives helps preserve data, and encryption protects confidentiality, but neither by itself guarantees that the data remains unchanged. Therefore, using a cryptographic hash like MD5 to fingerprint the evidence is the method that makes tampering detectable.