Question

During a forensic investigation, an analyst acquires a bit-for-bit copy of a suspect's hard drive. Before analysis, the analyst calculated a SHA-256 hash of the original evidence drive as 'a1b2c3...'. After the imaging process completes, the analyst calculates the hash of the acquired image file and gets '9f8e7d...'. What conclusion should the analyst draw about the disk image?

Accepted Answer

The image is tampered or corrupted because its hash does not match the original evidence drive

Answer

The image is a verified, forensically sound copy suitable for court

Answer

The mismatch is expected and normal because hashing an image always changes the value

Answer

The image is valid as long as the file sizes of the original and copy match