Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics · Due Diligence, Investigation & Forensic Accounting

In a forensic review of Sagar Metals Ltd, the investigator obtains the CFO's laptop and email server images. The company's lawyers plan to use the findings in court. Which action best protects the admissibility and reliability of the digital evidence?

The investigator should make a write-blocked forensic image, record hash values, document the chain of custody and analyse only the copy. This proves the evidence was not altered and supports admissibility, whereas using originals, CFO-selected emails or deleting originals compromises integrity.

  1. AAnalyse the original laptop directly to save time and then take notes from memory
  2. BCreate a forensic image using write-blocking, compute hash values, document chain of custody, and perform analysis on the copyCorrect
  3. CAsk the CFO to select and send the emails he considers relevant
  4. DPrint selected emails and delete the electronic originals

Explanation

A write-blocked bit-stream image with hash verification shows the copy matches the original and was not altered, and the chain of custody records handling. Working on the original risks modification, and CFO-selected data suffers from self-interest bias. Deleting originals destroys evidence.

Did you get it right without looking?

One question tells you little. A timed set on Due Diligence, Investigation & Forensic Accounting shows your real accuracy, how long you take and where you lose marks.

Practise Due Diligence, Investigation & Forensic AccountingFree diagnostic mock

More Due Diligence, Investigation & Forensic Accounting questions