Question

During a fraud investigation, an IS auditor collects log files and a copy of a suspect employee's hard drive as potential evidence for possible legal proceedings. To ensure the evidence will be admissible and defensible, which action is MOST important for the auditor to perform?

Accepted Answer

Maintain a documented chain of custody recording every person who handled the evidence and when

Answer

Analyze the original hard drive immediately to preserve the timeliness of findings

Answer

Summarize the log files in the audit workpapers and discard the raw files

Answer

Obtain a signed statement from the suspect acknowledging the collection