CISA Certified Information Systems Auditor – Question0788

An employee who denies accusations of sending inappropriate images to other employees has been discharged. For evidential purposes, the mail database for the discharged employee’s computer should be:

A.
deleted as it could subject the organization to further legal liability
B. impounded by physically removing the disk drive
C. backed up to the server, where its access can be tightly restricted
D. copied to write-once, read-many media using the computer’s OS tools

Correct Answer: C