During the investigation of a computer crime, audit trails can be very useful. To ensure that the audit
information can be used as evidence, certain procedures must be followed. Which of the following is
NOT one of these procedures?

A.
Mechanisms should be in place to protect the integrity of the audit trail information.

B.
The audit trail information must be used during the normal course of business.

C.
There must be a valid organizational security policy in place and in use that defines the use of the
audit information.

D.
Audit trails should be viewed prior to the image backup.

Explanation:
The image backup should be done first in order not to modify any information on the hard disk. For
example, the authentication process applied to a hard disk can change the time of last access
information on files. Thus, authentication should be applied to a disk image copy.