You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is…

Question

Options

• Amake an MD5 hash of the evidence and compare it with the original MD5 hash that was taken
• Bmake an MD5 hash of the evidence and compare it to the standard database developed by NIST
• Cthere is no reason to worry about this possible claim because state labs are certified
• Dsign a statement attesting that the evidence is the same as it was when it entered the lab

• A
  77% (47)
• B
  13% (8)
• C
  3% (2)
• D
  7% (4)

Explanation

Cryptographic hashing (MD5 or stronger algorithms like SHA-256) produces a unique fixed-length fingerprint of a dataset. If even a single bit of evidence data changes, the hash value changes entirely. When evidence enters the lab, a hash is computed and recorded as part of chain of custody documentation. At any later point, recomputing the hash and comparing it to the original recorded hash provides mathematically verifiable proof that the evidence is bit-for-bit identical and has not been altered. This is the gold standard for digital evidence integrity. Option B is incorrect - the NIST hash database (NSRL) is used to identify known files (e.g., OS files), not to verify evidence integrity. Signed statements (D) are subjective and not cryptographically verifiable. Lab certification (C) does not prove the specific evidence was unaltered.

No community discussion yet for this question.