In the computer forensics investigation methodology, in which step would you run an MD5 checksum on the evidence?

• A. Evaluate and secure the scene
• B. Collect the evidence
• C. Obtain search warrant
• D. Acquire the data

Answer: (D)

Hashing the evidence to confirm integrity is done during the data acquisition phase. When you create the forensic image of the data, you generate an MD5 checksum of that image and record it in the case log. This provides a reproducible fingerprint showing that the copy matches the original and hasn’t been altered since acquisition, which is essential for admissibility and trust in the investigation. The other steps involve securing the scene, obtaining permission, or physically collecting items, but they do not produce or verify a verifiable copy with a hash at the moment of acquisition.