ITPEC FE Morning April 2018 Question 41

Hash Values in Digital Forensics — proving evidence integrity

In digital forensics, a hash value is used to prove that a copy of data is identical to the original, ensuring the duplicate can be admitted as evidence.

A hash is computed on the original data and again on the copy. If both values match, the copy is verified as untampered and authentic.

• •Correct answer: b) — proves identicalness between original and duplicate copy used as evidence

Why not others:
- a) One-way password hashing is a security storage technique, not a forensics purpose
- c) Hash functions are irreversible — they cannot restore altered data
- d) Detecting password tapping is handled by intrusion detection or audit logs, not hash comparison

Key rule: In forensics, hashing ensures evidence integrity — confirming that digital evidence has not been modified since collection.

AI-generated — may contain errors