Skip to content

CS Professional · Internal and Forensic Audit · Audit and Investigations

In a fraud probe at Bharat Steel Ltd, the forensic auditor copies the finance manager's laptop data. Which practice best preserves the integrity of this electronic evidence?

The auditor should make a forensic image using a write-blocker and record its hash value. The hash proves the copy matches the original and has not been changed, while opening files, deleting originals or letting the suspect send files would alter or filter the evidence.

  1. ACopy files by drag-and-drop onto a personal pen drive and delete the originals
  2. BCreate a forensic image of the drive using a write-blocker and record its hash valueCorrect
  3. COpen each file on the laptop to check contents before copying
  4. DAsk the manager to email the files to the auditor

Explanation

A forensic image taken through a write-blocker, with a hash value recorded, lets anyone later verify the copy is identical and unaltered. Opening files or deleting originals changes metadata, and having the suspect email files lets him select what to give.

Did you get it right without looking?

One question tells you little. A timed set on Audit and Investigations shows your real accuracy, how long you take and where you lose marks.

Practise Audit and InvestigationsFree diagnostic mock

More Audit and Investigations questions