An incident response team needs to preserve the integrity of evidence collected from a compromised server. Which hashing approach provides the strongest evidence of post-collection data integrity?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because SHA-256 (or stronger) provides cryptographically strong integrity verification; computing the hash immediately after collection and recording it in the chain of custody allows anyone handling the evidence to verify it hasn't been altered. A is wrong because MD5 has known cryptographic weaknesses (collision attacks); SHA-256 is the preferred standard for new forensic work, though MD5 is still common in practice.
Full explanation below image
Full Explanation
B is correct because SHA-256 (or stronger) provides cryptographically strong integrity verification; computing the hash immediately after collection and recording it in the chain of custody allows anyone handling the evidence to verify it hasn't been altered. A is wrong because MD5 has known cryptographic weaknesses (collision attacks); SHA-256 is the preferred standard for new forensic work, though MD5 is still common in practice. C is wrong because CRC32 is an error-detection code, not a cryptographic hash; it does not protect against intentional modification. D is wrong because file size comparison is not a reliable integrity check; an attacker or accidental modification could produce a file with the same size.