CAS-005 · Question #369
Which of the following is the best reason for obtaining file hashes from a confiscated laptop?
The correct answer is B. To later validate the integrity of each file. Obtaining file hashes from a confiscated laptop is primarily done to ensure that the integrity of each file can be validated later. By generating a hash of each file, investigators can later compare the hash values to ensure that no files have been altered or tampered with…
Question
Which of the following is the best reason for obtaining file hashes from a confiscated laptop?
Options
- ATo prevent metadata tampering on each file
- BTo later validate the integrity of each file
- CTo generate unique identifiers for each file
- DTo preserve the chain of custody of files
How the community answered
(60 responses)- A3% (2)
- B92% (55)
- C2% (1)
- D3% (2)
Explanation
Obtaining file hashes from a confiscated laptop is primarily done to ensure that the integrity of each file can be validated later. By generating a hash of each file, investigators can later compare the hash values to ensure that no files have been altered or tampered with during the investigation process. This helps confirm that the files remain unchanged from the time they were
Community Discussion
No community discussion yet for this question.