Compare and contrast two types of image

Implementing Cisco Cybersecurity Operations (210-255)

Disk Images

There are two types of disk images when dealing with forensic evidence. Unaltered images can be compared to the original using a hash like MD5 or SHA256 and will return the same hash as the original. Altered images have been tampered with and will not return the same hash as the original. It is important to maintain unaltered images for use with court proceedings.