Which of the following is most appropriate for validating that two copies of evidence are identical?

• A. Compare file names
• B. Rely on the original's appearance
• C. Use only the imaging date
• D. Compute and compare cryptographic hashes of both copies

Answer: (D)

The idea being tested is data integrity verification through cryptographic hashing. You validate that two copies of evidence are identical by computing a cryptographic hash of each copy and then comparing the resulting digests. A hash function takes the entire content and produces a fixed-size digest; even a tiny change in the data yields a vastly different hash. Because hash values are highly sensitive to any modification, matching hashes provide strong assurance that the copies are identical, which is essential for maintaining integrity in forensic work. Use a strong hash function (such as SHA-256) and apply it to the complete image data on both copies, then compare the results.

Relying on file names is unreliable because names can be renamed or duplicated without affecting the underlying data. Judging by appearance is misleading since tampering can be subtle and invisible to the eye. Imaging date alone does not reflect content integrity, as two different images could share the same date or be altered without changing the date.