What is the recommended method to verify the integrity of a forensic image after acquisition?

• A. Compute cryptographic hashes of the source and the image, compare them, and securely store the hash values and method used.
• B. Copy the image to another drive and re-run the imaging tool.
• C. Encrypt the image with a new key and store the key separately.
• D. Compare file sizes only.

Answer: (A)

You verify forensic image integrity by calculating cryptographic hashes for both the source data and the acquired image, then comparing them and securely storing the hash values and the method used. A cryptographic hash provides a compact, unique fingerprint of the exact bit pattern; if the hash of the source and the hash of the image match, you have strong evidence that the copy is a bit-for-bit replica and has not been altered during acquisition. Documenting the hash algorithm, tool, date, and storing the hash values supports a verifiable chain of custody and lets you reproduce the check later if needed. Encrypting the image protects confidentiality but doesn’t prove integrity. Simply copying and re-running tools or relying on file sizes alone don’t reliably detect changes, since data can be altered without changing size and without affecting a superficial check.