Cisco
200-201 · Question #558
What is a key difference between a tampered and an untampered disk image during a forensic investigation?
The correct answer is B. A tampered image has a different hash value, and untampered has the hash value unchanged.. A tampered disk image has been altered after acquisition, which changes its cryptographic hash and breaks integrity verification, while an untampered image retains the same hash value and can be validated as unchanged.
Submitted by the_admin· Mar 6, 2026Host-Based Analysis
Question
What is a key difference between a tampered and an untampered disk image during a forensic investigation?
Options
- AAn untampered image is encrypted, and a tampered one is not encrypted.
- BA tampered image has a different hash value, and untampered has the hash value unchanged.
- CA tampered image is accessible only by administrators, and an untampered one is accessible by
- DAn untampered image is compressed, and a tampered one is left uncompressed.
How the community answered
(20 responses)- A5% (1)
- B90% (18)
- C5% (1)
Explanation
A tampered disk image has been altered after acquisition, which changes its cryptographic hash and breaks integrity verification, while an untampered image retains the same hash value and can be validated as unchanged.
Topics
#disk imaging#forensic integrity#hashing#evidence tampering
Community Discussion
No community discussion yet for this question.