You can show that the evidence was not tampered with by

Question

Options

• ALooking at it
• BCyclical Check
• CMD5 hash of the original and copy
• DDocumenting it

• A
  5% (1)
• B
  14% (3)
• C
  77% (17)
• D
  5% (1)

Explanation

An MD5 hash acts as a digital fingerprint - if even a single bit of evidence changes, the hash value changes completely. By hashing both the original evidence and a copy and comparing the two values, you can mathematically prove the copy is identical and untampered, which is a foundational practice in digital forensics.

Why the distractors are wrong:

• A (Looking at it): Visual inspection is subjective and cannot detect subtle or hidden digital modifications - files can be altered without any visible change.
• B (Cyclical Check): This is vague and not a recognized standard for evidence integrity verification; you may be thinking of CRC (Cyclic Redundancy Check), but it's far weaker than cryptographic hashing and not used for forensic proof of tamper-evidence.
• D (Documenting it): Documentation is essential for chain of custody but proves handling history, not that the content itself is unchanged.

Memory tip: Think "MD5 = Match = Match = Untouched." If both hashes match, the evidence matches. Hash functions are used in digital forensics precisely because they're deterministic - same input always yields the same output, any change breaks the match.

No community discussion yet for this question.