According to IIFS100, the following is the proper sequence for image verification:

Question

Options

• AHash original, copy, hash copy, compare hash
• BHash on image stream, hash copy, compare hash
• CCopy, hash original, hash copy, compare hash
• DNone of the above

• A
  82% (28)
• B
  6% (2)
• C
  3% (1)
• D
  9% (3)

Explanation

Option A is correct because proper forensic image verification requires establishing a known-good baseline before any copying occurs. You hash the original first to capture its state, then create the copy, then hash the copy, and finally compare both hashes - if they match, the copy is a verified, bit-for-bit duplicate.

Option B is wrong because hashing "on the image stream" means hashing during the copy process rather than separately hashing the original first. This skips establishing a clean pre-copy baseline and conflates the copy step with the hash step.

Option C is wrong because it copies the original before hashing it. This is a critical error - you have no baseline hash of the original, so even if the hashes of original and copy eventually match, you cannot prove the copy reflects the original's pre-copy state (e.g., if copying caused a write-back error).

Memory tip: Think "Know Before You Go" - you must know the original's hash value before you go ahead and copy it. The sequence follows a simple logic: original → snapshot it (hash) → duplicate it → snapshot the duplicate → confirm they match.

No community discussion yet for this question.