Which practice best helps ensure ISO image integrity during forensic acquisition?

Which practice best helps ensure ISO image integrity during forensic acquisition?

• A. Use a non-forensic tool to read the image
• B. Compute and compare cryptographic hashes of the image and source
• C. Rename the image file for clarity
• D. Copy the image to a different filesystem to speed up access

Answer: (B)

Ensuring image integrity during forensic acquisition hinges on provable, tamper-evident verification of the data. The reliable way to do this is to create cryptographic hashes of both the original source media and the acquired image, then compare those hashes. If the hashes are identical, you have strong evidence that the image is a bit-for-bit replica of the source and that no alterations occurred during imaging, transfer, or storage. Using a strong algorithm (such as SHA-256) and securely recording and preserving those hash values supports a defensible chain of custody and admissibility in investigations or court. Reading the image with a non-forensic tool doesn’t provide a verifiable check of integrity and might introduce changes or metadata alterations. Renaming the image only changes the filename and does not verify or protect the contents. Copying the image to a different filesystem to speed access does not verify integrity and could introduce its own risks to the data or metadata. So, computing and comparing cryptographic hashes of the image and its source gives you a concrete, verifiable measure of integrity, which is why it’s the correct approach.

Ensuring image integrity during forensic acquisition hinges on provable, tamper-evident verification of the data. The reliable way to do this is to create cryptographic hashes of both the original source media and the acquired image, then compare those hashes. If the hashes are identical, you have strong evidence that the image is a bit-for-bit replica of the source and that no alterations occurred during imaging, transfer, or storage. Using a strong algorithm (such as SHA-256) and securely recording and preserving those hash values supports a defensible chain of custody and admissibility in investigations or court.

Reading the image with a non-forensic tool doesn’t provide a verifiable check of integrity and might introduce changes or metadata alterations. Renaming the image only changes the filename and does not verify or protect the contents. Copying the image to a different filesystem to speed access does not verify integrity and could introduce its own risks to the data or metadata.

So, computing and comparing cryptographic hashes of the image and its source gives you a concrete, verifiable measure of integrity, which is why it’s the correct approach.