CompTIA Security+ (SY0-701)Security OperationsMedium
A security analyst is conducting a forensic investigation after a suspected intrusion. To ensure the integrity and authenticity of the collected digital evidence, the analyst calculates a hash value of each piece of evidence immediately after acquisition and before any analysis. Which fundamental principle of digital forensics is being addressed by this action?
- ATimeliness
- BData Integrity
- CChain of Custody
- DOrder of Volatility
Show answer & explanationAnswer & explanation
Correct answer: B. Data Integrity
Calculating a hash value of digital evidence immediately after acquisition is a critical step to ensure data integrity. The hash acts as a unique digital fingerprint; any subsequent alteration to the evidence would change its hash, thus proving that the evidence has been tampered with. This ensures that the evidence presented in court or for internal investigations is authentic and unaltered.
Why the other options are wrong
- A. Timeliness refers to collecting evidence promptly, which is important but not directly addressed by calculating hash values.
- C. Chain of Custody focuses on documenting who had possession of the evidence and when, but hashing directly addresses *whether* the evidence itself changed.
- D. Order of Volatility dictates the sequence in which different types of evidence should be collected, focusing on data that is most likely to disappear quickly.
Data Integrity (Digital Forensics)
The principle in digital forensics that ensures digital evidence has not been altered, tampered with, or corrupted from the time it was collected until it is presented.
- Achieved primarily through cryptographic hashing.
- Crucial for admissibility of evidence in legal proceedings.
- Any change to the data will result in a different hash value.
Memory trick: COTID: Custody, Order, Timeliness, Integrity, Duplication.