Skip to content

CS Professional · Internal and Forensic Audit · Basic Concepts of Forensic Audit

A forensic auditor is asked to examine an employee's laptop in a suspected data-theft case at Kaveri Logistics Pvt. Ltd. Which action best reflects the professional skill of preserving evidence?

The auditor should make a forensic image of the drive, work only on that copy, and document the chain of custody. This keeps the original unaltered and preserves the evidence's credibility and admissibility in later proceedings.

  1. ABrowse files directly on the original laptop to find the documents quickly
  2. BAsk the employee to copy the relevant files to a pen drive and hand it over
  3. CCreate a forensic image of the drive and work on the copy, documenting the chain of custodyCorrect
  4. DDelete irrelevant personal files so only business data remains

Explanation

Working on a forensic image keeps the original unaltered, and a documented chain of custody shows who handled the evidence. Browsing the original or letting the suspect copy files can alter or taint evidence and weaken its admissibility.

Did you get it right without looking?

One question tells you little. A timed set on Basic Concepts of Forensic Audit shows your real accuracy, how long you take and where you lose marks.

Practise Basic Concepts of Forensic AuditFree diagnostic mock

More Basic Concepts of Forensic Audit questions