If an employee’s computer has been used by a fraudulent employee to commit a crime, the hard disk may be
seized as evidence and once the investigation is complete it would follow the normal steps of the Evidence Life
Cycle. In such case, the Evidence life cycle would not include which of the following steps listed below?

A.
Acquisition collection and identification

B.
Analysis

C.
Storage, preservation, and transportation

D.
Destruction

Explanation:
The evidence lifecycle does not include destruction. The evidence need to be preserved.
Incorrect Answers:
A: The evidence lifecycle include collection and identification of evidence.
B: Analysis of evidence is included in the evidence lifecycle.
C: The evidence lifecycle include storage, preservation, and transportation of evidence.

Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 1054