How is integrity of a forensic bit stream image often determined?

Change Image Delete

Asked by Cindymurray, Last updated: Nov 15, 2024

+ Answer

Request

0
Follow

Share

Answer Anonymously
Answer Later

Copy Link

2 Answers

D. gray, Builder, Builder, Las Vegas

Answered Mar 07, 2019

The integrity of a forensic bit stream image is often determined by comparing hash totals to the original source. Forensic investigators use hash algorithms to confirm that their forensic image is an exact copy of the original disk or volume.

This assists the forensic investigator with the image’s admissibility into court and helps maintain the integrity of the evidence. It can also be used as an investigation tool within a file system to help identify certain known good or bad files.
Hope this helps.

John Smith

Answered Oct 17, 2016

1. Comparing hash totals to the original source

Ensuring the authenticity and integrity of evidence is critical. If the courts feel the evidence or its copies are not accurate or lack integrity, it is doubtful that the evidence or any information derived from the evidence will be admissible. The current protocol for demonstrating authenticity and integrity relies on hash functions that create unique numerical signatures that are sensitive to any.