Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics · Due Diligence, Investigation & Forensic Accounting

In a forensic audit of Meghna Steel Ltd., the CA obtains the email server back-up of a suspected employee. To preserve the admissibility and integrity of the digital evidence, which approach should the CA follow?

The CA should make a forensic image of the data, record its hash value, maintain a documented chain of custody, and analyse only the copy. This preserves integrity and admissibility, whereas working on originals or relying on the suspect to supply emails risks tampering and weakens the evidence.

  1. AWork directly on the original server and delete irrelevant mails to simplify review
  2. BCreate a forensic image, record a hash value, maintain a chain of custody, and analyse the copy rather than the originalCorrect
  3. CPrint selected emails and discard the electronic files
  4. DAsk the suspected employee to select and forward the relevant emails

Explanation

Digital evidence must be preserved without alteration. A forensic image with a hash value proves the copy matches the original, and a documented chain of custody shows who handled it. Analysis is performed on the copy. Working on the original or letting the suspect select material risks alteration and compromises admissibility.

Did you get it right without looking?

One question tells you little. A timed set on Due Diligence, Investigation & Forensic Accounting shows your real accuracy, how long you take and where you lose marks.

Practise Due Diligence, Investigation & Forensic AccountingFree diagnostic mock

More Due Diligence, Investigation & Forensic Accounting questions