What does data immutability mean in digital forensics?

What does data immutability mean in digital forensics?

• A. Data that cannot be altered after creation
• B. Data that can be edited by anyone
• C. Data that is automatically deleted after 30 days
• D. Data that must be permanently encrypted

Answer: (A)

Data immutability in digital forensics means that once evidence is created or acquired, its contents cannot be altered without detection. This preserves the trustworthiness of the evidence so forensic analysis can be reproduced and verified. In practice, investigators seal copies with cryptographic hashes and use write blockers to prevent any accidental or intentional modification of the original data. If the data were changed, the hashes would no longer match, revealing tampering and breaking the chain of custody. Encryption protects confidentiality but does not prevent changes, so it doesn’t define immutability. Therefore, data that cannot be altered after creation best describes immutability.