During the investigation of a computer crime, audit trails can be very
useful. To ensure that the audit information can be used as evidence,
certain procedures must be followed. Which of the following is NOT
one of these procedures?

A.
Mechanisms should be in place to protect the integrity of the audit
trail information.

B.
The audit trail information must be used during the normal course
of business.

C.
There must be a valid organizational security policy in place and in
use that defines the use of the audit information.

D.
Audit trails should be viewed prior to the image backup.

Explanation:
The image backup should be done first in order not to modify any
information on the hard disk. For example, the authentication
process applied to a hard disk can change the time of last access
information on files. Thus, authentication should be applied to a disk
image copy.