CISM Certified Information Security Manager – Question1408

Of the following, which is the MOST important aspect of forensic investigations?

A.
The independence of the investigator
B. Timely intervention
C. Identifying the perpetrator
D. Chain of custody

Correct Answer: D

Explanation:

Explanation:
Establishing the chain of custody is one of the most important steps in conducting forensic investigations since it preserves the evidence in a manner that is admissible in court. The independence of the investigator may be important, but is not the most important aspect. Timely intervention is important for containing incidents, but not as important for forensic investigation. Identifying the perpetrator is important, but maintaining the chain of custody is more important in order to have the perpetrator convicted in court.