MD5 checksums serve what purpose in digital forensics?

• A. They ensure file integrity by detecting changes
• B. These checksums encrypt data
• C. They compress data to save space
• D. They assign random numbers to files

Answer: (B)

MD5 checksums act as a fingerprint of a file’s contents. In digital forensics, you generate a hash value from the file and store it as a reference. Later, you recompute the hash and compare it to the original. If the hashes match, the file has not changed; if they differ, something altered the file—whether through tampering, corruption, or an accidental modification. This is about verifying integrity, not about encrypting, compressing, or assigning random numbers. MD5 is fast and useful for quick checks, but it has known weaknesses, so practitioners often pair it with stronger hashes like SHA-256 for greater assurance.