GCFA · Question #285
Which of the following cryptographic methods are used in EnCase to ensure the integrity of the data, which is acquired for the investigation? Each correct answer represents a complete solution. Choose
The correct answer is A. MD5 B. CRC. EnCase uses MD5 hashing and CRC32 checksums to verify that acquired forensic evidence has not been altered. These two methods together provide both block-level and image-level integrity verification.
Question
Which of the following cryptographic methods are used in EnCase to ensure the integrity of the data, which is acquired for the investigation? Each correct answer represents a complete solution. Choose two.
Options
- AMD5
- BCRC
- CHAVAL
- DTwofish
How the community answered
(24 responses)- A83% (20)
- C13% (3)
- D4% (1)
Why each option
EnCase uses MD5 hashing and CRC32 checksums to verify that acquired forensic evidence has not been altered. These two methods together provide both block-level and image-level integrity verification.
MD5 generates a 128-bit hash of the entire acquired image, allowing investigators to verify that the evidence file is an exact bit-for-bit copy of the original. EnCase computes and records this hash at acquisition time and recomputes it during verification to detect any tampering.
CRC (Cyclic Redundancy Check) is used at the block level within EnCase evidence files (.E01) to verify the integrity of each 64-sector data block. This provides granular integrity checking so that corruption can be detected and located within the image.
HAVAL is a cryptographic hash function but it is not implemented in EnCase as one of its integrity verification mechanisms.
Twofish is a symmetric block cipher used for encryption, not a hashing or integrity verification algorithm, and is not used in EnCase for evidence integrity.
Concept tested: EnCase forensic image integrity verification methods
Source: https://www.opentext.com/products/encase-forensic
Topics
Community Discussion
No community discussion yet for this question.