A hard drive was imaged using EnCase. The original drive was placed into evidence. The restore feature was used to make a copy of the original hard drive. EnCase verifies the restored copy using:

Question

A hard drive was imaged using EnCase.  The original drive was placed into evidence.  The restore feature was used to make a copy of the original hard drive.  EnCase verifies the restored copy using:

Quizplus · Accepted Answer

EnCase uses an MD5 hash to verify the integrity of the restored copy by comparing it to the hash of the original drive to ensure data integrity and authenticity.

A Hard Drive Was Imaged Using EnCase