In which step of the computer forensics investigation methodology would you run MD5 checksum on the evidence?

The correct answer is D. Acquire the data. D - Acquire the Data. MD5 (and other hash algorithms like SHA-256) checksums are generated during the Data Acquisition phase. After creating a forensic image of the evidence, an MD5 hash is computed on both the original media and the image to verify they are identical. This…

Submitted by tyler.j· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

AObtain search warrant
BEvaluate and secure the scene
CCollect the evidence
DAcquire the data

How the community answered

(33 responses)

A
9% (3)
B
3% (1)
D
88% (29)

Explanation

D - Acquire the Data. MD5 (and other hash algorithms like SHA-256) checksums are generated during the Data Acquisition phase. After creating a forensic image of the evidence, an MD5 hash is computed on both the original media and the image to verify they are identical. This hash value serves as a digital fingerprint that proves the copy is an exact, unaltered duplicate of the original, ensuring evidence integrity.

Topics

#MD5 checksum#Data integrity#Evidence acquisition#Forensic methodology

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice