CMA Final · Cost and Management Audit · Forensic Audit
In digital forensic evidence handling during an investigation, which practice best preserves the admissibility of electronic evidence collected from an employee's laptop?
The best practice is to take a bit-by-bit forensic image using a write blocker, record a hash value to prove integrity, and maintain a documented chain of custody. This shows the evidence was not altered and was handled only by authorised persons, which supports its admissibility.
- ACreate a forensic bit-by-bit image using a write blocker, record a hash value and maintain a chain of custodyCorrect
- BCopy only the relevant files to a pen drive and delete the originals to avoid duplication
- CLet the employee's IT team browse the laptop to identify the files before imaging
- DTake screenshots of selected emails and discard the device
Explanation
A write-blocked bit-by-bit image with a hash value proves that the copy is identical to the original and was not altered, and a chain of custody log shows who handled it. Browsing the original or deleting files alters metadata and weakens integrity. Screenshots alone cannot be authenticated as fully as an image.
Did you get it right without looking?
One question tells you little. A timed set on Forensic Audit shows your real accuracy, how long you take and where you lose marks.
More Forensic Audit questions
- A forensic auditor interviewing a suspect in an alleged cost-record falsification plans the sequence of interviews. Which sequence is genera…
- Which of the following is the most appropriate description of a 'red flag' in a forensic audit of a company's purchasing function?
- A forensic auditor applies Benford's Law to the invoice amounts of a vendor and finds that the digit 9 appears as the first digit far more o…
- In a forensic investigation of a suspected procurement fraud, an auditor takes a verified bank statement, invoices and vendor master data an…
- In a forensic audit of a manufacturing firm, the investigator finds that the same purchase invoice was paid twice, once through cheque and o…
- In a forensic investigation of a suspected procurement fraud, which of the following best describes the purpose of the 'chain of custody' fo…