CHFI Computer Forensics Fundamentals and Process Practice Question

During a forensic investigation, the analyst needs to verify the integrity of a forensic image. The analyst originally computed MD5 and SHA-1 hashes of the source drive. Which action BEST ensures the image has not been altered?

⚠ Common exam trap

EC-Council often tests the misconception that using a write blocker or checking file size is sufficient for integrity verification, but the trap is that only cryptographic hash comparison provides the mathematical proof required to detect any alteration.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Recompute MD5 and SHA-1 hashes of the image and compare with the original

Recomputing the MD5 and SHA-1 hashes of the forensic image and comparing them to the original values is the definitive method to verify integrity. Hash functions produce a fixed-size digest that changes completely if even a single bit of the image is altered, providing cryptographic assurance that the image is an exact bit-for-bit copy of the source drive. This process directly validates data integrity, which is a core requirement in forensic acquisition.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Recompute MD5 and SHA-1 hashes of the image and compare with the original
Why this is correct
Cryptographic hash algorithms such as MD5 and SHA-1 generate a fixed-size digest that is computationally infeasible to reverse, so recomputing these hashes over the entire image and matching them against the original acquisition hashes confirms that every bit of the image remains unchanged since capture. Because MD5 and SHA-1 use different mathematical constructions, matching both simultaneously makes an accidental collision astronomically unlikely, and this is the standard integrity verification method accepted in forensic practice.
✗
Check that the image was created using a write blocker
Why it's wrong here
A write blocker is a hardware or software device used during acquisition to prevent any write operations from reaching the subject drive, thereby preserving the original evidence, but its use is a one-time safeguard and says nothing about whether the resulting image file was later altered, corrupted, or truncated. Verifying that a write blocker was used only establishes a clean acquisition process; it cannot demonstrate that the image you currently hold is bit-for-bit identical to the source media at the time of imaging.
✗
Compare the file size of the image with the original drive's capacity
Why it's wrong here
The stated capacity of an original drive is the total number of addressable sectors, while a forensic image can be compressed, sparse, or contain padding, so its file size will almost never equal the drive's raw capacity and the two values are not directly comparable. More fundamentally, file size only measures quantity of data and contains no information about the actual bits; two completely different images can share the same byte length, and even if sizes match, not a single bit of content is validated.
✗
Open the image in FTK Imager and browse a few files
Why it's wrong here
Browsing a handful of files in FTK Imager lets the analyst view directory listings and sample file content, but it only touches a tiny, human-selected subset of the image and completely skips unallocated space, slack space, and deleted artifacts where evidence and corruption often hide. This approach provides a quick visual sanity check rather than a mathematical proof of integrity; a single corrupted sector outside the viewed files would go completely unnoticed, and the visible files might coincidentally look intact while the rest of the image is damaged.

Go deeper

CHFI Computer Forensics Fundamentals and Process Practice Question

Why each option matters

Option-by-option breakdown

Related to this question