What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)

Untampered disk images are essential for security investigations because they provide an accurate and uncorrupted snapshot of the system's state at the time of compromise, preserving crucial forensic evidence.

Tampered images have been altered after acquisition, making them unreliable and inadmissible for accurate security investigations due to compromised integrity.

If the stored hash and the computed hash match, it indicates the image has not been tampered with, verifying its integrity, not that it is tampered.

While a recovery process might involve restoring from a backup, using a tampered image for recovery would introduce unknown malicious or corrupt data back into the system, potentially reintroducing the compromise.

An image is considered untampered, and thus forensically sound, if its stored cryptographic hash (taken at the time of acquisition) matches the hash computed when the image is later accessed or verified.