Mile2 CDFE Practice Questions - Mile2 Certified Digital Forensics Examiner (CDFE) Exam

Access More Questions

A forensic examiner calculates an MD5 hash of a disk image immediately after acquisition and again after analysis. The hashes differ. What does this indicate?

The disk image was modified after acquisition The original drive was encrypted The hash algorithm is outdated The chain of custody form was not filled out

Correct Answer:

The disk image was modified after acquisition

Access more questions from this quiz

Continue to Mile2 CDFE Practice Questions - Mile2 Certified Digital Forensics Examiner (CDFE) Exam for more practice questions and the full quiz experience.

Access More Questions