header bg

Scan QR code or get instant email to install app

Question:

After collecting a forensic image of a drive using FTK Imager, Albus wants to verify that he has a reliable copy. Which step should he take next?

A Compare an MD5 or SHA-1 hash of the drive to the image.
explanation

To confirm that he has a complete and accurate image of the source drive, Albus should use the hashing functions that are built into the system and compare either an MD5 or SHA-1 hash value of the source drive to a hash generated using the same function on the image. If the two values match, it indicates that he has a valid and undamaged image. None of the other options can provide confirmation that the entire drive was imaged correctly.

Related Information

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

*