When should an MD5 hash check be performed when processing evidence?

The correct answer is C. Before and after evidence examination. MD5 hash checks must be performed both before and after evidence examination. The hash taken before examination establishes a cryptographic baseline-a fingerprint proving the original state of the evidence. The hash taken after examination is compared to the baseline to verify…

Submitted by naveen.iyer· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

AAfter the evidence examination has been completed
BOn an hourly basis during the evidence examination
CBefore and after evidence examination
DBefore the evidence examination has been completed

How the community answered

(51 responses)

A
4% (2)
C
90% (46)
D
6% (3)

Explanation

MD5 hash checks must be performed both before and after evidence examination. The hash taken before examination establishes a cryptographic baseline-a fingerprint proving the original state of the evidence. The hash taken after examination is compared to the baseline to verify that the evidence was not altered, corrupted, or tampered with during the investigation process. This two-step verification is a fundamental principle of maintaining forensic integrity and chain of custody.

Topics

#Evidence Integrity#Hashing#Forensic Procedures#Data Authentication

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice