Which statement is NOT part of disk imaging tool requirements?

• A. Not change the original content
• B. Log I/O errors in an accessible form
• C. Withstand peer review
• D. Should not compute a hash value for the complete bit stream copy

Answer: (D)

In forensic disk imaging, the tool must keep the original data intact, provide a clear audit trail, and be capable of withstanding scrutiny by others. Not changing the original content means the imaging process should be read-only or use a write blocker to prevent any alteration of evidence. Logging I/O errors in an accessible form creates an auditable record of what happened during the imaging, which is essential for later validation and chain-of-custody reviews. Withstanding peer review ensures that the method and results are reproducible and trusted by the forensic community.

Computing a hash value for the complete bit stream copy is a standard part of this process because it allows you to verify that the image exactly matches the source and remains unchanged over time. Saying you should not compute a hash conflicts with that critical integrity check. Therefore the statement about not computing a hash is not part of the proper disk-imaging requirements.