CompTIA Security+ SY0-701 Practice Question

Creating a digital hash of the hard drive image is critical to maintain the integrity of the investigation. Hashing the image ensures that an investigator can verify that the evidence has not been altered from the time of acquisition. This process establishes a unique digital fingerprint for the data at the moment of capture, which can be compared against the data at any point afterward to confirm that it remains unaltered. Physically securing the server and limiting access to the server are important, but they do not address the integrity of the digital evidence after its acquisition. Documenting the process is also essential but secondary to securing the image's integrity through hashing.