Skip to content

CS Professional · Internal and Forensic Audit · Fraud Detecting Techniques

A forensic auditor receives a suspected fraudulent contract on a laptop at a Hyderabad firm and must preserve it for use as evidence. Which action best protects its evidential integrity?

Make a forensic bit-stream image, record its hash value, analyse only the copy and maintain a documented chain of custody. This shows the evidence is unaltered and supports admissibility, whereas opening, resaving, deleting or emailing the original changes metadata and breaks custody.

  1. ACreate a forensic bit-stream image, compute a hash value, and work only on the copy while documenting chain of custodyCorrect
  2. BOpen the original file and save it under a new name for review
  3. CPrint the document and delete the electronic file to avoid confusion
  4. DEmail the file to the audit team for quick review

Explanation

A bit-stream image with a hash value proves the copy matches the original, and analysis on the copy leaves the original unaltered, with chain of custody recorded. Opening or resaving the original changes metadata and weakens admissibility. Deleting or emailing the file breaks the chain of custody.

Did you get it right without looking?

One question tells you little. A timed set on Fraud Detecting Techniques shows your real accuracy, how long you take and where you lose marks.

Practise Fraud Detecting TechniquesFree diagnostic mock

More Fraud Detecting Techniques questions