The MD5 message-digest algorithm is used to ____________.

• A. hash a disk to verify that a disk is not altered when you examine it
• B. encrypt the disk
• C. compress the disk image
• D. decrypt the files

Answer: (A)

MD5 is a hashing function used to verify data integrity. In digital forensics, you compute an MD5 digest of a disk or disk image and store that value; later you recompute the digest and compare it to the original. If the hashes match, you can be confident the data hasn’t been altered during handling or examination. MD5 is not encryption, compression, or decryption—the digest is not reversible and does not conceal content, it simply provides a compact fingerprint of the data.