EnCase stores evidence in its proprietary E01 format. During acquisition the data are written in fixed-size blocks; for each block EnCase calculates and records a 32-bit cyclic-redundancy-check (CRC) value. When the image is later opened or verified, every block’s CRC is recomputed and compared with the stored value. A single-bit alteration anywhere in the evidence changes that CRC, causing immediate verification failure, which makes post-acquisition tampering practically impossible. (An overall MD5/SHA-1 hash is also generated, but block-level CRC is the mechanism that protects “every byte” after acquisition.)

A. EnCase computes one MD5 (and optional SHA) for the whole image, not a separate hash for every byte; it lacks per-byte granularity.
C. Merely duplicating data to multiple drives is an external practice, not an intrinsic EnCase integrity control.
D. EnCase evidence files are not automatically encrypted, and encryption alone does not provide tamper-evidence detection.

1. Guidance Software. “The EnCase Evidence File Format,” v2, §2.3 “CRC And Compression Blocks” (pp. 5-6) – describes 32-bit CRC on each data block.

2. Nelson, B., Phillips, A., & Steuart, C. Guide to Computer Forensics and Investigations, 6th ed., Cengage, 2019, Ch. 6, pp. 245-246 – explains EnCase’s per-block 32-bit CRC integrity check.

3. NIST. “Digital Data Acquisition Tool Test Results – Guidance Software EnCase Forensic v7,” Report #FDTC-ENF-2013, §4.2 – notes CRC stored for every acquisition block and its role in verification.