What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)

What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)
A . Untampered images are used in the security investigation process
B . Tampered images are used in the security investigation process
C . The image is tampered if the stored hash and the computed hash match
D . Tampered images are used in the incident recovery process
E . The image is untampered if the stored hash and the computed hash match

View Answer

Answer: AE

Explanation:

Cert Guide by Omar Santos, Chapter 9 – Introduction to digital Forensics. "When you collect evidence, you must protect its integrity. This involves making sure that nothing is added to the evidence and that nothing is deleted or destroyed (this is known as evidence preservation)."