Skip to content

CS Professional · Internal and Forensic Audit · Basic Concepts of Forensic Audit

A forensic auditor at Bharat Agro Ltd obtains a copy of the laptop hard drive of a finance executive suspected of fraud. To keep the electronic evidence admissible and reliable, which practice is most appropriate?

The auditor should create a forensic image of the drive, preserve the original, document the chain of custody and analyse only the copy. This protects the integrity and admissibility of the evidence, unlike altering originals or relying on files chosen by the suspect.

  1. AWork on the original drive and delete irrelevant files to save space
  2. BCreate a forensic image, document the chain of custody and analyse the copyCorrect
  3. CAsk the executive to select the files he wishes to hand over
  4. DPrint selected emails and discard the digital files

Explanation

Evidence integrity needs a bit-by-bit forensic image, with the original preserved and a documented chain of custody; analysis is done on the copy. Working on the original or letting the suspect select files compromises integrity. Discarding the digital files loses metadata.

Did you get it right without looking?

One question tells you little. A timed set on Basic Concepts of Forensic Audit shows your real accuracy, how long you take and where you lose marks.

Practise Basic Concepts of Forensic AuditFree diagnostic mock

More Basic Concepts of Forensic Audit questions