A bank forensic analyst images a seized workstation disk and records one hash of the original disk and one hash of the image. Why are the two hashes recorded?
Select an answer to reveal the explanation.
Short Explanation
Matching serial numbers tell you the spare is the part you packed. You hash the original and the image to show the copy matches. The trap is treating that hash as an encryption key, a CVSS rating, or a cipher choice.
Full Explanation
The right selection is "To show data integrity, confirming the forensic image hash exactly matches the hash of the original disk". A hash is a digest of the bytes. When the digest of the image equals the digest of the original, the copy is the same bytes and the image is fit to analyze. NIST SP 800-86 uses that comparison as an integrity check. The statement "To encrypt the original disk in the lab by using the recorded hash string as the encryption key" misunderstands a digest as a cryptographic key, and hashing the disk does not encrypt it. The statement "To assign a CVSS rating for the workstation by treating the two hash strings as the score" mixes a file fingerprint with vulnerability scoring, and a hash string is not an attack-vector or impact metric. The statement "To choose the cipher suite for the bank's next encrypted session from the characters in the hash" mixes a fingerprint with TLS negotiation, and a disk digest does not select algorithms for a later session. Exam caveat: a match shows the copy was identical when both hashes were taken, and it does not by itself name who created the files on the disk. Operational check: compute both digests with the same algorithm and compare them before analysis writes anything to the working copy.