Ethan, a forensic investigator, is analyzing a suspect's computer and finds a suspicious file that...

Within the CHFI v11 curriculum, verifying theintegrity of digital evidenceis a core responsibility of a forensic investigator. The most reliable method to determine whether a file has been tampered with is by examining itscryptographic hash value. A hash value (such as MD5 or SHA-256) is a fixed-length digital fingerprint generated from the file’s contents. Even the smallest change to the file—whether intentional or accidental—will produce a completely different hash value, making hash comparison a definitive method for detecting manipulation.

File system logs (Option A) can help reconstruct timelines by showing access or modification events, but logs can be deleted, altered, or incomplete and do not directly validate file content integrity. Hidden attributes or alternate data streams (Option B) are indicators of possible anti-forensics techniques, yet their presence does not confirm that the primary file data was altered. Access Control Lists (Option C) only describe permission settings and ownership, not whether the file itself was modified.

According to the CHFI v11 objectives underDigital Evidence,Data Acquisition, andEvidence Validation, investigators must calculate and verify hash values during acquisition and analysis to maintainchain of custody, ensureevidence integrity, and supportlegal admissibility. This makes hash examination the most appropriate and forensically sound choice in this scenario