What is a difference between tampered and untampered disk images?

The correct answer is C. Untampered images are used for forensic investigations. The disk image must be intact for forensics analysis. As a cybersecurity professional, you may be given the task of capturing an image of a disk in a forensic manner. Imagine a security incident has occurred on a system and you are required to perform some forensic…

Submitted by yaw92· Mar 6, 2026Host-Based Analysis

Question

Options

ATampered images have the same stored and computed hash.
BTampered images are used as evidence.
CUntampered images are used for forensic investigations.
DUntampered images are deliberately altered to preserve as evidence

How the community answered

(17 responses)

A
6% (1)
B
6% (1)
C
88% (15)

Explanation

The disk image must be intact for forensics analysis. As a cybersecurity professional, you may be given the task of capturing an image of a disk in a forensic manner. Imagine a security incident has occurred on a system and you are required to perform some forensic investigation to determine who and what caused the attack. Additionally, you want to ensure the data that was captured is not tampered with or modified during the creation of a disk image process.

Topics

#disk forensics#data integrity#forensic imaging

Community Discussion

No community discussion yet for this question.

Full 200-201 Practice