The integrity of a forensic bit stream image is often determined by comparing hash totals to the original source. Forensic investigators use hash algorithms to confirm that their forensic image is an exact copy of the original disk or volume.
This assists the forensic investigator with the image’s admissibility into court and helps maintain the integrity of the evidence. It can also be used as an investigation tool within a file system to help identify certain known good or bad files.
Hope this helps.
Ensuring the authenticity and integrity of evidence is critical. If the courts feel the evidence or its copies are not accurate or lack integrity, it is doubtful that the evidence or any information derived from the evidence will be admissible. The current protocol for demonstrating authenticity and integrity relies on hash functions that create unique numerical signatures that are sensitive to any.
Answer Anonymously
Copy Link
