Which of the following is the MOST effective way for an IS auditor to ensure information is preserved when conducting a forensic investigation?

The correct answer is B. Image residual data and deleted files.. The forensic principle is to preserve evidence in its original state. Imaging-including capturing residual and deleted data-ensures that the full contents of a storage device are preserved for analysis while maintaining the chain of custody. Hardening (A) may alter system state.

Submitted by anna_se· Apr 18, 2026Protection of Information Assets

Question

Options

AHarden computer hardware and software.
BImage residual data and deleted files.
CEncode system logs and intrusion detection system (IDS) logs.
DDocument all application programming interface (API) connections with third parties.

How the community answered

(33 responses)

A
6% (2)
B
79% (26)
C
3% (1)
D
12% (4)

Explanation

The forensic principle is to preserve evidence in its original state. Imaging-including capturing residual and deleted data-ensures that the full contents of a storage device are preserved for analysis while maintaining the chain of custody. Hardening (A) may alter system state. Encoding logs (C) is not preservation but transformation. Documenting APIs (D) helps investigation scope but does not preserve evidence. ISACA guidance on digital forensics stresses the importance of bit-level imaging and ensuring evidence integrity through hashing and proper custody

Topics

#Forensic Investigation#Evidence Preservation#Digital Forensics#IS Auditing Best Practices

Community Discussion

No community discussion yet for this question.

Full CISA Practice