An incident handler is preparing a forensic image of a hard drive. Which of the following MUST be done to provide evidence that the image is an exact…

Digital hashing is the standard and mandatory procedure in digital forensics to verify the integrity of a forensic image. A cryptographic hash function (e.g., SHA-256, MD5) is applied to both the original source media and the created image. If the resulting alphanumeric strings, or hash values, are identical, it provides mathematical proof that the image is a bit-for-bit, exact duplicate of the original. This verification is critical for ensuring the evidence is authentic, unaltered, and admissible in legal or formal investigations.

A. Manual file counts are insufficient as they do not verify file content, deleted data, or unallocated space, and cannot prove a bit-for-bit copy.

B. Encrypting the original drive before imaging fundamentally alters the evidence, violating the forensic principle of preserving the evidence in its original state.

C. Using identical hardware is not a requirement for creating a valid forensic image; the integrity of the data copy is the primary concern, not the hardware used.

1. NIST Special Publication 800-86

Guide to Integrating Forensic Techniques into Incident Response. Section 3.2.2

"Imaging

" states

"To verify that the copy is an exact duplicate of the original

a hashing algorithm is used to generate a value for the original media and the copy. If the values match

it is an exact duplicate."

2. ISO/IEC 27043:2015

Information technology — Security techniques — Incident investigation principles and processes. Section 7.3.4

"Assurance

" discusses the need to demonstrate the integrity of acquired digital evidence. It specifies that "the integrity of the potential digital evidence should be demonstrated by using appropriate mechanisms (e.g. cryptographic hash)."

3. Casey

E. (2011). Digital Evidence and Computer Crime: Forensic Science

Computers

and the Internet (3rd ed.). Academic Press. Chapter 8

"Data Acquisition

" details the process of creating forensic duplicates and emphasizes the use of hash values (MD5

SHA-1

etc.) to verify the integrity of the acquired image against the original source media. This is a foundational textbook in university-level digital forensics courses.