Exam CISA topic 1 question 1385 discussion

Option A, where the investigator installed forensic software on the original drive that contained the evidence, could also impact the authenticity of the evidence. Installing software on the original drive might modify or alter the data, thus compromising its integrity. Forensic best practices recommend making a bit-for-bit copy of the drive and performing analysis on the copy to avoid altering the original evidence. In summary, both options A and D can affect the authenticity of digital evidence, but D is generally considered more critical because it directly involves potential changes to the original data while it is being collected.

A is correct.

The right answer will be D due to the inherent risk of modifications and potential compromises to the chain of custody, collecting evidence from a copy of the disk data presents the greatest concern regarding its authenticity in a forensic investigation. It's important to note that the validity of digital evidence ultimately depends on a holistic assessment of all collection, handling, and analysis procedures. Consulting with experts and following established forensic methodologies are crucial for ensuring the admissibility and reliability of digital evidence.