CISA Certified Information Systems Auditor – Question0418

Which of the following is MOST important to ensure that electronic evidence collected during a forensic investigation will be admissible in future legal proceedings?

A.
Restricting evidence access to professionally certified forensic investigators
B. Engaging an independent third party to perform the forensic investigation
C. Performing investigative procedures on the original hard drives rather than images of the hard drives
D. Documenting evidence handling by personnel throughout the forensic investigation

Correct Answer: D