What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)

Tampered images are not used in security investigations because their integrity is compromised, making any findings from them unreliable and inadmissible as evidence.

Tampered images are not used in incident recovery; recovery processes typically rely on known-good backups or clean system reinstallation, not corrupted images.

If the stored hash and computed hash match, it indicates the image has NOT been tampered with, contrary to this statement.

Untampered disk images are essential for security investigations because they represent a true and unaltered snapshot of the system at a specific time, providing reliable forensic evidence. This allows investigators to analyze the state of the system, identify malware, and understand the attacker's actions without fear of the evidence itself being compromised.

An image is considered untampered if its computed cryptographic hash (e.g., MD5, SHA256) matches a previously stored, known-good hash value, indicating that the data has not been altered since the hash was recorded. This hash integrity check is a fundamental principle of forensic evidence preservation, ensuring the reliability and admissibility of the disk image in an investigation.