An IS auditor is supporting a forensic investigation. An image of affected storage media has been captured while collecting digital forensic evidence. Which of the following techniques would BEST enab

Question

Options

• AFile allocation table
• BHash value
• CAccess control list
• DSize of the file

• A
  6% (1)
• B
  82% (14)
• D
  12% (2)

Explanation

Hash values (typically MD5 or SHA-256) are the standard forensic method for verifying image integrity: a cryptographic hash is computed on both the original media and the captured image, and if the two hashes match exactly, it proves the image is a bit-for-bit replica with no alterations - even a single changed bit produces a completely different hash.

Why the distractors fail:

• A (File Allocation Table): The FAT tracks where files are stored on a filesystem, but it can be identical between two drives that differ in raw content - it doesn't prove the entire image is unchanged.
• C (Access Control List): ACLs define permissions for files/directories; they say nothing about whether the data itself has been modified or copied accurately.
• D (Size of the file): File size can match between two images even when contents differ (e.g., a byte changed but overall size stays the same), so it's an unreliable integrity check.

Memory tip: Think of a hash as a "digital fingerprint" - just as no two people share the same fingerprint, no two different datasets produce the same cryptographic hash. If the fingerprints match, the copies are identical twins.

No community discussion yet for this question.