Forensic Checksums and Data Integrity
Short answer
D The analyst is practicing integrity by using a checksum to ensure the email file has not been altered.
Question
Key Takeaways
This question tests the ability to distinguish between different security concepts by identifying that checksums are specifically used to verify data integrity rather than other attributes like non-repudiation or chain of custody.
Creating a checksum verifies that digital evidence has not been altered, ensuring data integrity. This process is essential for maintaining the validity of forensic investigations.
Common mistake: Learners often confuse integrity with non-repudiation because both involve verification. However, non-repudiation proves who sent data (usually via digital signatures), while integrity proves the data hasn't changed.
Expert Analysis
Why the Answer Is Correct
Integrity ensures that data has not been altered or tampered with during storage or transmission. In forensics, creating a checksum (hash) provides a mathematical representation of the file's contents; if even a single bit changes, the hash value will differ completely, proving the file's integrity was maintained.
Why the Other Options Are Wrong
Chain of custody tracks the physical handling and transfer of evidence, not its content state. Data recovery focuses on retrieving lost or deleted files, which is distinct from verifying existing ones. Non-repudiation prevents a user from denying their actions, typically requiring cryptographic signatures rather than simple checksums.
Community Comment Notes
The community overwhelmingly agrees on this answer. Comments such as "Checksum = Integrity" highlight the direct association learners should make between these terms. One commenter noted that checking hashes ensures they match the original message, reinforcing the concept of consistency.
Exam Strategy
When you see 'checksum', 'hash', or 'verify unchanged', think immediately of Integrity. When you see 'digital signature' or 'PKI', think Non-repudiation. Keep these definitions distinct for the exam.
Frequently Asked Questions
Why isn't this non-repudiation?
What is the difference between integrity and chain of custody?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
[Removed] 👍 4 Answered DThe analyst is looking at the checksum. A checksum is repeating a message and checking the hashes to make sure that the hash from the original message is the same, hence maintaining integrity. correct me if I'm wrong.
-
salah112 👍 2 Answered DD. Integrity Creating a checksum of the affected subject's email file is an action that verifies the integrity of the file. In digital forensics, the process of creating a checksum involves generating a hash value (checksum) for a file. If the file remains unchanged, the hash value should remain consistent. If any alterations occur in the file, the hash value would differ, indicating a potential integrity issue.
-
aquarshie 👍 1Checksum = Integrity
-
shady23 👍 1 Answered DD. Integrity
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.