What is a common practice to verify the integrity of disk images after acquisition?

• A. Computing and comparing hash values with a known good value
• B. Re-imaging the disk
• C. Deleting the image
• D. Encrypting the image

Answer: (A)

Verifying a disk image’s integrity hinges on cryptographic hashing. The idea is to generate a fingerprint (hash) of the captured image and compare it to a trusted hash value recorded at acquisition or provided by the imaging tool. Because cryptographic hashes are highly sensitive to every bit, a match shows the image is a bit-for-bit exact replica of the source media, with no alterations or corruption. This practice supports reproducibility and chain of custody: you can re-check the image later and have confidence it hasn’t changed.

In practice, you compute the hash value on the original media or on the created image and compare it to the known good value. A match means the integrity is preserved; a mismatch signals tampering or corruption, prompting re-acquisition or further investigation. Encrypting the image protects confidentiality but does not by itself verify integrity, and re-imaging or deleting the image does not provide a validity check for the original copy.