Question

what are the three rules for a forensic hash?
a. it can be predicted; only two files can have the same hash value; and if the file changes, the hash value changes.
b. it cannot be predicted; only two files can have the same hash value; and if the file changes, the hash value changes.
c. it can be predicted; no two files can have the same hash value; and if the file changes, the hash value changes.
d. it cannot be predicted; no two files can have the same hash value; and if the file changes, the hash value changes.

Explanation:

Forensic hashes rely on three core properties: 1. The hash value cannot be predicted from the input data (one-way property). 2. No two distinct files should produce the same hash value (collision resistance). 3. Any change to the file, no matter how small, will result in a different hash value (avalanche effect).

Answer:

d. It cannot be predicted; no two files can have the same hash value; and if the file changes, the hash value changes.