When electronically stored information is requested during a fraud investigation, which of the following should be the FIRST priority?
A.
Assigning responsibility for acquiring the data
B.
Locating the data and preserving the integrity of the data
C.
Creating a forensically sound image
D.
Issuing a litigation hold to all affected parties
Explanation:
Locating the data and preserving data integrity is the only correct answer because it represents the primary responsibility of an investigator and is a complete and accurate statement of the first priority. While assigning responsibility for acquiring the data is a step that should be taken, it is not the first step or the highest priority.
Creating a forensically sound image may or may not be a necessary step, depending on the type of investigation, but it would never be the first priority. Issuing a litigation hold to all affected parties might be a necessary step early on in an investigation of certain types, but not the first priority.