ExamGecko
Question list
Search
Search

Question 220 - CISM discussion

Report
Export

The PRIMARY reason to create and externally store the disk hash value when performing forensic data acquisition from a hard disk is to:

A.
validate the confidentiality during analysis.
Answers
A.
validate the confidentiality during analysis.
B.
reinstate original data when accidental changes occur.
Answers
B.
reinstate original data when accidental changes occur.
C.
validate the integrity during analysis.
Answers
C.
validate the integrity during analysis.
D.
provide backup in case of media failure.
Answers
D.
provide backup in case of media failure.
Suggested answer: C

Explanation:

The disk hash value is a unique identifier that is calculated from the binary data of the disk. It is used to verify that the disk image is an exact copy of the original disk and that no changes have occurred during the acquisition or analysis process. The disk hash value is stored externally, such as on a CD-ROM or a USB drive, to prevent tampering or corruption.The disk hash value can also be used as evidence in court to prove the authenticity and reliability of the digital evidence123Reference=1: CISM Review Manual 15th Edition, ISACA, 2017, page 2532: Guide to Computer Forensics and Investigations Fourth Edition, page 4-103: Forensic disk acquisition over the network, Andrea Fortuna, 2018. The main purpose of creating and storing an external disk hash value when performing forensic data acquisition from a hard disk is to validate the integrity of the data during the analysis. This is done by comparing the original hash value of the disk to the hash value created during the acquisition process, which can be used to ensure that the data has not been tampered with or corrupted in any way. Additionally, by creating a hash value of the disk, it can be used to quickly verify the integrity of any data that is accessed from the disk in the future.

asked 01/10/2024
Carlotta Agape
39 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first