Why is it necessary to calculate hash values on the primary image made from a suspect’s hard drive? How many hash calculations do you make?
What will be an ideal response?
You calculate the hash value for the original volume and compare it to the value you get from the copy. They must match. If not, you need to figure out why it doesn’t and document the reason. How many do you make? That’s kind of a trick question. Ideally, you will make two calculations for each copy. If you have both MDA5 and a SHA-256 calculations for each copy, and each version matches, it will be very difficult for the opposition to challenge the validity of your copies.
You might also like to view...
For each of the following sets of integers, write a single statement that will display a number at random from the set.
Assume Random randomNumbers = new Random() has been defined and use the one-parameter version of method Random.Next. a) 2, 4, 6, 8, 10. b) 3, 5, 7, 9, 11. c) 6, 10, 14, 18, 22.
In a microkernel architecture, the kernel typically includes only a small number of services, such as ________; most other services, such as ________, execute outside of the kernel with a lower privilege level.
a) interprocess communication, low-level memory management b) networking, process management c) low-level memory management, file system management d) device management, networking