Because digital forensics tools have limitations in performing hashing, what tools should be used to ensure data integrity?

• A. Hash calculators
• B. Hexadecimal editors
• C. Forensic suites
• D. Disk Wipers

Answer: (B)

Hashing is the trusted way to confirm that evidence hasn’t changed. To guarantee data integrity, you should use tools that reliably generate and verify cryptographic hashes (such as a dedicated hash calculator or hashing features built into a forensic suite). Before you start work, compute a hash of the original data; after imaging or transferring, compute the hash again and compare. If the two hashes match, the data is intact. Forensic suites often automate this process, logging hashes and preserving chain of custody, which reduces human error and strengthens evidentiary integrity. Hexadecimal editors focus on viewing or editing raw bytes and do not provide robust, automated hash verification, and can even alter data. Disk wipers erase data, not verify it, so they’re not appropriate for ensuring integrity in an investigation.