When should an MD5 hash check be performed during evidence processing?

• A. Before the evidence examination has been completed
• B. On an hourly basis during the evidence examination
• C. Before and after evidence examination
• D. After the evidence examination has been completed

Answer: (C)

Maintaining the integrity of digital evidence relies on hashing at key moments. Generating an MD5 hash before you begin the examination captures a baseline value of the evidence as received, providing a reference to detect any changes during processing. Recomputing the hash after the examination verifies that the data remained unchanged throughout and that the results reflect the original material, helping support the chain of custody and tamper-detection. Doing it only before could miss alterations that occur during analysis, and doing it only after could fail to confirm the starting state. An hourly check is impractical and could still miss mid-process changes. Therefore, performing an MD5 hash check both before and after the evidence examination is the best practice.