Skip to content

CS Professional · Internal and Forensic Audit · Audit and Investigations

During a fraud inquiry at Orion Pharma Ltd., a forensic auditor images the hard disk of a suspect employee's laptop. Which step is most essential to keep the electronic evidence admissible and reliable?

The auditor should make a bit-by-bit forensic image, record its hash value and maintain a documented chain of custody. This shows the data was not altered and who handled it, supporting admissibility and reliability, whereas working on originals or letting the suspect select files compromises integrity.

  1. AWorking directly on the original laptop to save time
  2. BCreating a bit-by-bit forensic copy, computing a hash value and documenting the chain of custodyCorrect
  3. CDeleting irrelevant files before analysis to reduce volume
  4. DAsking the employee to copy relevant files to a pen drive

Explanation

A bit-by-bit image verified by a hash value, with documented custody, shows the evidence was not altered and can be traced. Working on the original risks changing data, deleting files destroys evidence, and employee-selected files lack integrity and completeness.

Did you get it right without looking?

One question tells you little. A timed set on Audit and Investigations shows your real accuracy, how long you take and where you lose marks.

Practise Audit and InvestigationsFree diagnostic mock

More Audit and Investigations questions