Question

Answer (Detailed Solution Below)

Option 4 : The two hashes were computed over different scopes, such as a logical volume at seizure versus the full physical device in the lab

Detailed Solution

सही उत्तर The two hashes were computed over different scopes, such as a logical volume at seizure versus the full physical device in the lab है।

Key Points

Helpful?

prepsnap.in • Part -A

Question:

After acquisition, the SHA-256 of the forensic image does not match the hash recorded at seizure, although a write blocker was used throughout. The most likely explanation is / अधिग्रहण के बाद फॉरेंसिक इमेज का SHA-256 जब्ती के समय दर्ज हैश से मेल नहीं खाता, जबकि पूरे समय राइट ब्लॉकर लगा था। सबसे संभावित कारण है

SHA-256 is unsuitable for forensic hashing and MD5 should be used instead

The write blocker silently failed and the operating system wrote to the source disk

Hash mismatch always proves intentional tampering by the examiner

The two hashes were computed over different scopes, such as a logical volume at seizure versus the full physical device in the lab

Correct Answer: The two hashes were computed over different scopes, such as a logical volume at seizure versus the full physical device in the lab

A hash only proves integrity when computed over the identical byte range; hashing a partition at seizure and the whole disk later guarantees a mismatch even with perfect handling. / हैश तभी मान्य है जब दोनों बार एक ही बाइट-रेंज पर गिना गया हो; पार्टीशन बनाम पूरे डिस्क की हैशिंग स्वाभाविक रूप से अलग होगी। Option (b) is the trap — a failed blocker is possible but far less likely than a scope error, and it must not be assumed without evidence.

Downloaded from PrepSnap (prepsnap.in)