200-201 · Question #282
What are two differences between tampered disk images and untampered disk images? (Choose two.)
The correct answer is C. Untampered images can be used as law enforcement evidence. E. The image is untampered if the existing stored hash matches the computed one. The image is untampered if the stored hash and the computed hash match. When performing digital forensics, a common practice is to compute the hash value (such as MD5 or SHA-256) of the original disk image and store it separately. During the investigation, the computed hash…
Question
What are two differences between tampered disk images and untampered disk images? (Choose two.)
Options
- AThe image is tampered if the stored hash and the computed hash are identical.
- BTampered images are used as an element for the root cause analysis report.
- CUntampered images can be used as law enforcement evidence.
- DTampered images are used in a security Investigation process.
- EThe image is untampered if the existing stored hash matches the computed one.
How the community answered
(37 responses)- A3% (1)
- B8% (3)
- C86% (32)
- D3% (1)
Explanation
The image is untampered if the stored hash and the computed hash match. When performing digital forensics, a common practice is to compute the hash value (such as MD5 or SHA-256) of the original disk image and store it separately. During the investigation, the computed hash value of the acquired disk image should match the stored hash value to ensure that the image has not been tampered with or altered in any way. If the stored and computed hashes match, it suggests that the image is untampered and can be considered reliable as evidence.
Topics
Community Discussion
No community discussion yet for this question.