As part of a forensic investigation, Narcissa has obtained a drive image. She wishes to confirm that the drive image is identical to the original. What should she generate and record to authenticate this?

MD5 or SHA1 hashing is frequently employed to verify that a forensic image corresponds to the original drive. Numerous forensic duplicators automatically produce a hash of both drives at the conclusion of the imaging process to establish a documentation trail for the forensic artifacts. A third image may be helpful, but it does not serve as validation. Directory listings do not confirm that drives match, and photographs, while useful in documenting drives and serial numbers, do not verify the contents of the drives.