A digital investigator is presented with a forensic image whose hash value does not match the original evidence hash. This is most significant because:
-
A
Hash values frequently change due to time zone differences
-
B
It indicates the forensic image may have been altered, threatening evidentiary integrity
-
C
Minor hash mismatches are acceptable industry practice
-
D
It only matters if the defense raises the issue at trial