What is the purpose of hashing a copy of a suspect drive?

• A. To check for changes
• B. To encrypt data
• C. To compress data
• D. To improve performance

Answer: (A)

Hashing a copy of a suspect drive is about verifying integrity and reproducibility of the evidence. When you create a forensic image, you compute a cryptographic hash of the copy. That hash serves as a unique fingerprint of the data at that moment. Later, you recompute the hash of the image and compare it to the original value. If they match, the copy has not changed since acquisition; if they differ, something altered the data. This provides verifiable proof of integrity for the chain of custody and for court admissibility. Hashing is not encryption—it doesn’t hide content; it’s a one-way fingerprint. It’s not compression, which would alter data or reduce size, and it isn’t about performance.