Tampered images are disk images that have been modified or altered in some way after they were captured from the original source. Tampered images may have different stored and computed hash values, which indicate that the integrity of the image has been compromised. Tampered images are not reliable or valid sources of evidence for forensic investigations, as they may contain false or misleading information.
Untampered images are disk images that have not been changed or manipulated after they were acquired from the original source. Untampered images have the same stored and computed hash values, which verify that the image is an exact copy of the original disk. Untampered images are used for forensic investigations, as they preserve the original state and content of the disk and provide accurate and trustworthy evidence. References:
* Contrasting tampered and untampered disk images
* What is a difference between tampered and untampered disk images?

The lack of data visibility needed to detect the attack is caused by the threat actor gaining access to the system by known credentials. This means that the threat actor either obtained the employee's username and password through phishing, social engineering, or other means, or used a compromised account that had legitimate access to the system. This would explain why there were no suspicious logs, alerts, or failed login attempts, as the threat actor appeared to be a normal user. Reference: https://learningnetworkstore.cisco.com/on-demand-e-learning/understanding-cisco-cybersecurity-operations-fundamentals-cbrops-v1-0/CSCU-LP-CBROPS-V1-028093.html (Module 2, Lesson 2.1.2)