When performing a computer forensic investigation, in regard to the evidence gathered, an IS auditor should be
MOST concerned with:

A.
analysis.

B.
evaluation.

C.
preservation.

D.
disclosure.

Explanation:
Preservation and documentation of evidence for review by law enforcement and judicial authorities are of
primary concern when conducting an investigation. Failure to properly preserve the evidence could jeopardize
the acceptance of the evidence in legal proceedings. Analysis, evaluation and disclosure are important but not
of primary concern in a forensic investigation.