What is the purpose of computing and comparing hashes in digital forensics?

• A. To encrypt data
• B. To verify the integrity of files
• C. To compress data
• D. To speed up file search

Answer: (B)

The main idea is integrity verification. In digital forensics, hashes are used to create a unique digital fingerprint of data at a specific point in time. When you acquire evidence, you compute its hash and store it. Later, you compute the hash again and compare it to the original: if the hashes match, you can trust that the file or image has not been altered during storage, transport, or analysis. This helps prove that copies are exact and that the evidence remains admissible and reproducible. Hashing isn’t encryption, compression, or a tool for speeding searches; its purpose is to detect any changes to the data and maintain the integrity of the evidence throughout the investigation.