| Exam 200-201 | Question id=6057 | Security policies and procedures |
What is a difference between tampered and untampered disk images?
| A. |
Tampered images have the same stored and computed hash. | |
| B. |
Untampered images are deliberately altered to preserve as evidence. | |
| C. |
Tampered images are used as evidence. | |
| D. |
Untampered images are used for forensic investigations. |