Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics · Due Diligence, Investigation & Forensic Accounting

During a forensic investigation into alleged diversion of funds at Meridian Steels Ltd., the investigator obtains the email server image of the suspect, Mr. Iyer, and plans to present findings in court. Which action best preserves the evidentiary value of the digital evidence?

The investigator should make a forensic bit-stream image, record hash values, document chain of custody and analyse only the copy. This shows the evidence is unaltered and admissible. Working on originals, deleting mails, printing only or relying on suspect-forwarded mails compromises integrity.

  1. AWork directly on the original server and delete irrelevant mails to reduce volume
  2. BCreate a forensic bit-stream copy, compute and record hash values, maintain chain of custody documentation and analyse only the copyCorrect
  3. CPrint selected emails and discard the electronic files
  4. DAsk the suspect to forward relevant mails to the investigator's personal account

Explanation

Digital evidence integrity is shown by a forensic image, hash values to prove it is unaltered, and a documented chain of custody; analysis is done on the copy. Working on the original or deleting data alters evidence. Printing alone loses metadata, and suspect-forwarded mails are unreliable and can be selectively chosen.

Did you get it right without looking?

One question tells you little. A timed set on Due Diligence, Investigation & Forensic Accounting shows your real accuracy, how long you take and where you lose marks.

Practise Due Diligence, Investigation & Forensic AccountingFree diagnostic mock

More Due Diligence, Investigation & Forensic Accounting questions