When should an MD5 hash check be performed during processing of evidence?

• A. After the Evidence Examination Has Been Completed
• B. On an Hourly Basis During the Evidence Examination
• C. Before and After Evidence Examination
• D. Before the Evidence Examination Has Been Completed

Answer: (C)

Verifying evidence integrity relies on having a trusted fingerprint of the data before processing and then confirming it remains unchanged after processing. Computing the MD5 hash upfront creates a baseline fingerprint of the exact evidence or forensic image you will analyze. Storing that value securely lets you detect any alteration before you begin. After you finish the examination, recomputing the MD5 on the same evidence and comparing it to the baseline shows whether the data stayed unchanged during handling and analysis. If the hashes match, you can attest that the evidence’s integrity was preserved; if they differ, you have a clear indication of modification or corruption that needs investigation. Doing this only after the examination or on an hourly basis during processing would miss baseline assurance or window-specific changes, respectively. Therefore, performing the hash check both before and after the examination provides the proper end-to-end integrity check.