What technique used by Encase makes it virtually impossible to tamper with evidence once it has been
acquired?
A.
Every byte of the file(s) is given an MD5 hash to match against a master file
B.
Every byte of the file(s) is verified using 32-bit CRC
C.
Every byte of the file(s) is copied to three different hard drives
D.
Every byte of the file(s) is encrypted using three different methods
Structure of e01 (Encase Image File Format) File: –
The e01 image file format is prefixed with a “Case Info” header.
After every block of 64 sectors i.e. 32 KB, it is interlaced with CRCs (Cyclic Redundancy Check).
CRC is an error–detection code to check for any accidental changes in the original data. CRC is basically a hash function.
The footer of the e01 file contains an MD5 hash value of the entire imaged data.