Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics · Due Diligence, Investigation & Forensic Accounting

In a forensic investigation into suspected bribery at Ganga Infra Ltd, the investigating CA obtains the email data of the suspect's work laptop. Which action best preserves the evidential value of the digital evidence?

The investigator should make a write-protected forensic image of the drive, record hash values and keep a chain of custody log. This proves the evidence has not been altered and preserves its admissibility, unlike browsing originals, selective copying or relying on the suspect to forward emails.

  1. ABrowse the original laptop files directly and note the relevant ones
  2. BCreate a forensic image of the drive using write-protection, record hash values and maintain a chain of custody logCorrect
  3. CCopy only the relevant emails to a pen drive for convenience
  4. DAsk the suspect to forward the relevant emails to the investigator

Explanation

Evidence integrity requires a bit-for-bit forensic image with write-blocking, hash values to prove it is unaltered, and a documented chain of custody. Browsing originals changes metadata, selective copying loses context, and self-forwarded emails can be manipulated by the suspect.

Did you get it right without looking?

One question tells you little. A timed set on Due Diligence, Investigation & Forensic Accounting shows your real accuracy, how long you take and where you lose marks.

Practise Due Diligence, Investigation & Forensic AccountingFree diagnostic mock

More Due Diligence, Investigation & Forensic Accounting questions