What is the purpose of data integrity verification when creating forensic images?

• A. To ensure bit-for-bit copy matches the original, using hash verification (MD5/SHA-256).
• B. To speed up copying by skipping duplicates.
• C. To encrypt copies for storage.
• D. To compress data to save space.

Answer: (A)

The main idea is that data integrity verification confirms the forensic image is an exact, unaltered replica of the original evidence. This is done by generating a cryptographic hash of the source media before imaging and then computing a hash of the acquired image after imaging, comparing the two hashes. If they match, you’ve demonstrated that the copy is bit-for-bit identical and has not been modified during imaging, transfer, or storage. Using hash values such as MD5 or SHA-256 provides a reproducible, tamper-evident check that supports the reliability and defensibility of the evidence, and these values are typically recorded and kept with the chain of custody.

Why this matters in practice: hash verification ensures that subsequent analysis is performed on an exact copy, preserving the integrity of the original data and enabling independent verification by others. It also helps detect any accidental or intentional changes that could compromise the investigation.

The other options don’t fulfill this purpose: speeding up copying by skipping duplicates doesn’t guarantee the copied data is identical; encrypting protects confidentiality but not the integrity of the content itself; compressing saves space but can alter data unless perfectly lossless, which still requires integrity checks to confirm exactness.