When performing a computer forensic investigation, in regard to the evidence gathered, an IS
auditor should be MOST concerned with:

A.
analysis.

B.
evaluation.

C.
preservation.

D.
disclosure.

Explanation:
Preservation and documentation of evidence for review by law enforcement and judicial authorities
are of primary concern when conducting an investigation. Failure to properly preserve the evidence
could jeopardize the acceptance of the evidence in legal proceedings. Analysis, evaluation and
disclosure are important but not of primary concern in a forensic investigation.