An analyst calculates hashes before and after imaging a hard drive. The hashes do not match. What does this MOST likely indicate?

The correct answer is C. Evidence integrity has been compromised. Hash mismatches mean the data changed, indicating possible contamination or tampering, which invalidates forensic integrity.

Submitted by asante_acc· Mar 6, 2026Forensics Processes

Question

Options

ACompression was used during imaging
BThe imaging tool is incompatible
CEvidence integrity has been compromised
DThe disk contains encrypted files

How the community answered

(54 responses)

A
4% (2)
B
2% (1)
C
89% (48)
D
6% (3)

Explanation

Hash mismatches mean the data changed, indicating possible contamination or tampering, which invalidates forensic integrity.

Topics

#forensic imaging#data integrity#hashing#evidence tampering

Community Discussion

No community discussion yet for this question.

Full 300-215 Practice