What is the purpose of using MD5 in disk examination?

• A. To hash a disk to verify that it is not altered during examination
• B. To encrypt sensitive data
• C. To compress the disk image
• D. To wipe the disk

Answer: (A)

MD5 is a hash function used to create a fixed-size fingerprint of data. In disk examination, you generate an MD5 hash of the disk image before you start analyzing and then re-compute it after the examination. If the two hashes match, it shows with high confidence that the disk contents were not altered during handling, preserving the integrity and credibility of the evidence. This isn’t encryption, and it doesn’t compress or wipe data; hashing simply provides a way to detect any change. In practice, investigators often pair MD5 with other hashes (like SHA-256) to strengthen integrity verification, but the basic purpose remains ensuring the disk image remains unchanged during examination.