ITPEC FE Morning April 2018 Question 41

Which of the following is an appropriate purpose of using a hash value in digital forensics?

a)To convert a password with a one-way function so that recovery is not possible, then store itb)To prove the identicalness between the original and the duplicate copy of the data that can be used as evidencec)To restore altered data to its original form so that it can be used as evidenced)To verify whether password tapping occurred or not

Explanation

Proving the duplicate is identical to the original — in forensics a hash value shows that evidence has not changed since it was collected.

When digital evidence is acquired, the investigator computes a hash (for example SHA-256) of the original medium and of the forensic copy. Matching hash values show that the copy is bit-for-bit identical, so the analysis can be done on the copy while the original stays untouched. Recomputing the hash later shows the evidence was not altered while it was handled, which supports its use in court.

Answer (b)

Why not others:

•(a) — storing passwords as one-way hashes is a technique for protecting stored credentials, not a forensic purpose
•(c) — a hash is a one-way digest; it can reveal that data changed, but it cannot restore the original content
•(d) — comparing hashes does not show whether a password was eavesdropped; that needs traffic monitoring or log analysis, and the defence is an encrypted channel

Key rule: A hash detects change but cannot undo it, which makes it the tool for proving the integrity of evidence.

Security · AI-written, may contain errors

Previous Next

Practice this exam

This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.