- Home
- All questions
- Question 507
CompTIA Security+ study material · question 507 of 611
What does recomputing a hash of an evidence image months after acquisition demonstrate?
Show the answer
Answer: D. That the evidence has not changed since it was collected
Integrity is what the hash proves; custody and legality are established by separate records.
Source: NIST SP 800-86 (NIST) — SP 800-86 § 4.2 Collecting Files