Skip to content

CS Professional · Internal and Forensic Audit · Cyber Forensics

A forensic auditor at a Mumbai company records the SHA-256 hash of a disk image at acquisition and again before presenting the findings. The two values are identical. What does this most directly demonstrate?

Matching hash values show that the image has not been altered between acquisition and presentation. A hash acts as a digital fingerprint, so any change in the data would produce a different value. It proves integrity, not guilt, file recovery or absence of encryption.

  1. AThat the employee under investigation is innocent
  2. BThat the image has not been altered since acquisitionCorrect
  3. CThat all deleted files have been recovered
  4. DThat the disk contained no encrypted data

Explanation

A hash is a fixed digital fingerprint of the data. Identical values at two points in time show the image content did not change in between, supporting integrity. It says nothing about guilt, recovery of deleted files or encryption.

Did you get it right without looking?

One question tells you little. A timed set on Cyber Forensics shows your real accuracy, how long you take and where you lose marks.

Practise Cyber ForensicsFree diagnostic mock

More Cyber Forensics questions