Which of the following will invalidate the authenticity of digital evidence in a forensic investigation?

A. The investigator installed forensic software on the original drive that contained the evidence.

B. The evidence was collected from analysis of a copy of the disk data.

C. A software write blocker was used in the collection of the evidence.

D. The investigator collected the evidence while the machine was still powered on.








 

Suggested Answer: A





This question is in CISA Certified Information Systems Auditor Exam
For getting Certified Information Systems Auditor (CISA) Certificate










Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by ISACA. 
Trademarks, certification & product names are used for reference only and belong to ISACA.
The website does not contain actual questions and answers from ISACA's Certification Exams.