Exam CAS-005 topic 1 question 49 discussion

❌ Why the other options are incorrect: A. To prevent metadata tampering on each file Hashes don't prevent tampering — they detect it. C. To generate unique identifiers for each file Hashes can serve as identifiers, but the main purpose in forensics is to verify integrity. D. To preserve the chain of custody of files Chain of custody refers to tracking who has handled the evidence, not to hashing the files

✅ B. To later validate the integrity of each file 🔍 Explanation: Obtaining file hashes (like MD5, SHA-1, or SHA-256) from a confiscated laptop is a forensic best practice used to: Ensure files have not been altered since the time of seizure. Validate the integrity of the data at later stages of an investigation or in court. By comparing the original hash values to those calculated later, investigators can prove the files remain unchanged, maintaining their evidentiary value.