An incident response team needs to preserve the integrity of evidence collected from a compromised server. Which hashing approach provides the strongest evidence of post-collection data integrity?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — use a SHA-256 hash computed immediately after collection and verified before analysis, with both values documented in the chain of custody record. That gives you cryptographically strong proof the evidence hasn't been altered. MD5, CRC32, and file-size checks don't provide that level of assurance.
Full Explanation
The correct approach is the SHA-256 hash computed immediately after collection and verified before analysis, with documentation of both values in the chain of custody record. SHA-256 (or stronger) provides cryptographically strong integrity verification; computing the hash immediately after collection and recording it in the chain of custody allows anyone handling the evidence to verify it hasn't been altered. The MD5 hash only approach is wrong because MD5 has known cryptographic weaknesses (collision attacks); SHA-256 is the preferred standard for new forensic work, though MD5 is still common in practice. The CRC32 checksum approach is wrong because CRC32 is an error-detection code, not a cryptographic hash; it does not protect against intentional modification. The visual inspection of file sizes approach is wrong because file size comparison is not a reliable integrity check; an attacker or accidental modification could produce a file with the same size.