What hashing algorithms are commonly used to verify forensic image integrity, and what order should you apply them?

• A. MD5 only, never SHA-256.
• B. CRC32 as primary hash, with SHA-256 as optional.
• C. SHA-3 only, with no comparison.
• D. SHA-256 as the primary hash, optionally MD5/SHA-1 for quick checks; compute hash of source and image and compare.

Answer: (D)

When checking forensic image integrity, you rely on cryptographic hashes that uniquely reflect the data. SHA-256 is preferred as the main hash because it offers strong security and a long, collision-resistant digest, making it reliable for confirming that two copies are identical. You can use MD5 or SHA-1 as optional, quicker checks, but they should not be relied on as the sole proof of integrity due to known weaknesses.

The recommended approach is to compute the hash on both the original source (the evidence or the trusted file you acquired) and the extracted or copied image, using SHA-256 as the primary hash. You may also compute MD5 or SHA-1 alongside for speed, but you must compare all computed digests between source and image. If the SHA-256 values (and any other hashes you computed) match, the image is a faithful copy of the source. If they differ, something altered the data during transfer or handling.

Why the other options don’t fit: relying on MD5 alone is insecure; CRC32 is not cryptographically strong and can miss tampering. A setup that uses SHA-3 exclusively without any comparison is ineffective because you must compare against a known-good value to verify integrity.