When performing a computer forensic investigation, in regard to the evidence gathered, an IS
auditor should be MOST concerned with:

A.
analysis.

B.
evaluation.

C.
preservation.

D.
disclosure.

Explanation:

Preservation and documentation of evidence for review by law enforcement and judicial authorities
are of primary concern when conducting an investigation. Failure to properly preserve the
evidence could jeopardize the acceptance of the evidence in legal proceedings. Analysis,
evaluation and disclosure are important but not of primary concern in a forensic investigation.