Which statement best describes a legitimate use of the MD5 utility in digital forensics?

• A. Wipe magnetic media before recycling it
• B. Make directories on an evidence disk
• C. View graphics files on an evidence drive
• D. Verify that a disk has not been altered during examination

Answer: (D)

Hash values are used to prove data hasn’t changed. The MD5 utility creates a fixed-length digest from the contents of a file or disk image, which you can compare at different stages of handling to confirm integrity. In practice, you generate the MD5 sum when you first acquire evidence and recheck it later; if the hash matches, you have confidence that the disk has not been modified during examination. That makes verifying that a disk has not been altered the legitimate use of MD5 in digital forensics. Wiping media, creating directories, or simply viewing graphics aren’t about checking data integrity with a hash, so they don’t align with how MD5 is intended to be used.