How should cryptographic hash digest(s) be used in a forensic investigation?

A. Anytime a forensics image is created from an evidence items a new hash digest should be calculated. Comparing hash digests will show whether or not the original evidence item has changed.

B. An initial hash digest should be calculated for evidence items such as hard drives as soon as they are collected and before performing analysis on evidence drives. Analysis can then be performed on the original drive(s). After the analysis is completed a second hash digest can be calculated. Comparing the original hash digest with the second hash digest will show whether or not the original evidence item has changed.

C. An initial hash digest should be calculated for the forensics image created from evidence items such as hard drives. The initial hash digest should be created immediately after the forensic image is created and prior to performing analysis on the image. Analysis can then be performed on the image file. After the analysis is completed a second hash digest can be calculated from the image file. Comparing the original hash digest with the second hash digest will show whether or not the forensics image has changed.

D. Cryptographic hashes are not used in forensics. They are only used to protect passwords.