Skip to content

CS Professional · Internal and Forensic Audit · Audit and Investigations

A forensic auditor seizes a suspect employee's laptop during an investigation into data theft at a Pune IT company. To keep the digital evidence admissible and credible, what should the auditor do before analysing the contents?

The auditor should make a forensic image of the drive, analyse only the copy, and record the chain of custody. This preserves the original unaltered, protects its integrity and keeps the evidence credible and admissible if produced before a court.

  1. ACreate a forensic image of the drive and work on the copy, documenting the chain of custodyCorrect
  2. BBrowse the original files directly to find relevant emails quickly
  3. CDelete personal files to reduce the volume of data
  4. DAsk the suspect to copy the relevant files to a pen drive

Explanation

Digital evidence must be preserved without alteration. A bit-by-bit forensic image allows analysis on the copy while the original stays intact, and the chain-of-custody record shows who handled it. Browsing the original changes metadata and may make the evidence challengeable.

Did you get it right without looking?

One question tells you little. A timed set on Audit and Investigations shows your real accuracy, how long you take and where you lose marks.

Practise Audit and InvestigationsFree diagnostic mock

More Audit and Investigations questions