Study. uk . com
  1. Home
  2. All questions
  3. Question 507

CompTIA Security+ study material · question 507 of 611

What does recomputing a hash of an evidence image months after acquisition demonstrate?

  1. That the chain of custody was maintained
  2. That the analysis conclusions were correct
  3. That the evidence was legally obtained
  4. That the evidence has not changed since it was collected
Show the answer

Answer: D. That the evidence has not changed since it was collected

Integrity is what the hash proves; custody and legality are established by separate records.

Source: NIST SP 800-86 (NIST) — SP 800-86 § 4.2 Collecting Files

Challenge yourself on this topic → Study as cards