CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Cyber Security
During a forensic investigation, an examiner computes a hash value (such as SHA-256) of a seized disk image at acquisition and again before producing it in court. What is the main purpose of comparing these two values?
Comparing the hash values shows that the image is unchanged since acquisition. Any alteration, even of a single bit, would produce a different digest, so matching values support the integrity and authenticity of the electronic evidence.
- ATo encrypt the image so that it cannot be read by others
- BTo recover deleted files from unallocated space
- CTo demonstrate that the image has not been altered since acquisitionCorrect
- DTo compress the image to save storage space
Explanation
A hash function produces a fixed-length digest that changes if even one bit of the data changes. Matching hashes show integrity of the evidence. Hashing does not encrypt, recover or compress data.
Did you get it right without looking?
One question tells you little. A timed set on Cyber Security shows your real accuracy, how long you take and where you lose marks.
More Cyber Security questions
- A Mumbai-based fintech company discovers that an attacker has gained unauthorised access to its customer database through a compromised serv…
- As part of cyber security governance, a listed company's board wants a single accountable executive to design the information security progr…
- Which statement about the liability of an 'intermediary' under the IT Act, 2000 is correct?
- A forensic examiner must collect evidence from a running server that is suspected to be compromised. Considering the order of volatility, wh…
- A company's risk register shows that a phishing attack on its payroll system has a high likelihood and a moderate impact. Management buys cy…
- A Mumbai-based firm's payment portal is flooded with millions of fake requests from many compromised computers, making it unavailable to gen…