Computer Hacking Forensic Investigator (CHFI v10) — Question 506

When should an MD5 hash check be performed when processing evidence?

Answer options

• A. After the evidence examination has been completed
• B. On an hourly basis during the evidence examination
• C. Before and after evidence examination
• D. Before the evidence examination has been completed

Correct answer: C

Explanation

The correct answer is C because performing an MD5 hash check both before and after the evidence examination ensures the integrity of the evidence has been maintained throughout the process. Option A is incorrect as it only checks after, missing the initial integrity verification. Option B is impractical and unnecessary, while Option D fails to confirm the evidence's integrity post-examination.