Isaca Certified Information Systems Auditor CISA Question # 87 Topic 9 Discussion
CISA Exam Topic 9 Question 87 Discussion:
Question #: 87
Topic #: 9
Which of the following is MOST important to ensure that electronic evidence collected during a forensic investigation will be admissible in future legal proceedings?
A.
Restricting evidence access to professionally certified forensic investigators
B.
Documenting evidence handling by personnel throughout the forensic investigation
C.
Performing investigative procedures on the original hard drives rather than images of the hard drives
D.
Engaging an independent third party to perform the forensic investigation
The most important factor to ensure that electronic evidence collected during a forensic investigation will be admissible in future legal proceedings is to document evidence handling by personnel throughout the forensic investigation. Documentation is essential to establish the chain of custody, prove the integrity and authenticity of the evidence, and demonstrate compliance with legal and ethical standards. Documentation should include information such as the date, time, location, source, destination, method, purpose, result, and authorization of each action performed on the evidence. Documentation should also include any observations, findings, assumptions, limitations, or exceptions encountered during the investigation. References:
CISA Review Manual (Digital Version)
CISA Questions, Answers & Explanations Database
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit