In digital forensics, what is the primary purpose of hashing the evidence container?

• A. To compress data
• B. To verify integrity
• C. To label with metadata
• D. To encrypt data

Answer: (B)

Hashing the evidence container creates a fixed-size fingerprint of its exact contents at a specific moment. This fingerprint is unique to the data, so any alteration—no matter how small—produces a different hash. By recording the hash when the evidence is collected and rechecking it later, investigators can prove the container hasn’t been tampered with during transport or analysis, upholding the integrity of the evidence and the chain of custody. Hashing is not about compressing data or encrypting it; it’s about providing a reliable integrity check that helps detect any changes.