What is a difference between tampered and untampered disk images?
A. Tampered images have the same stored and computed hash.
B. Untampered images are deliberately altered to preserve as evidence.
C. Tampered images are used as evidence.
D. Untampered images are used for forensic investigations.
Tampered images are used as evidence, untampered images are never used for forensic investigations, that would destroy the evidence.
-Altered disk image: A system image with a compromised integrity.
-Unaltered disk image: An image that has not been tampered with and that will provide the same result as the original when applied a hash algorithm like MD5.
D is the correct answer.
You cannot use Tampered images as evidence.