How should hash values and the method used be stored for future integrity verification?

• A. Store hash values in a public web server.
• B. Store hash values in a shared folder without access control.
• C. Store hash values and the method used in a secure, access-controlled repository.
• D. Keep hashes on the imaging workstation only.

Answer: (C)

Verifying integrity reliably hinges on having a trusted, tamper-evident record of both the hash values and the algorithm used to generate them. Storing both the hashes and the hashing method in a secure, access-controlled repository provides tamper resistance, an audit trail, and versioning, which supports a defensible forensic process, chain of custody, and reproducible verifications in the future. This setup ensures that later checks are performed against a known baseline that cannot be easily altered by unauthorized users or a compromised workstation.

Storing hashes on a public web server exposes them to potential tampering or spoofing; placing them in a shared folder without access control leaves them open to unauthorized modification; and keeping hashes only on the imaging workstation creates a single point of failure that’s vulnerable if that system is compromised.