Certified Information Security Manager (CISM) — Question 677

The PRIMARY reason to create and externally store the disk hash value when performing forensic data acquisition from a hard disk is to:

Answer options

• A. validate the integrity during analysis
• B. provide backup in case of media failure
• C. reinstate original data when accidental changes occur
• D. validate the confidentiality during analysis

Correct answer: A

Explanation

The correct answer is A because the primary purpose of the disk hash value is to ensure that the data has not been altered during analysis by confirming its integrity. Options B, C, and D are incorrect as they focus on backup, restoration of data, and confidentiality, which are not the primary reasons for hashing in forensic investigations.