When electronically stored information is requested during a fraud investigation, which of the following should be the FIRST priority?
A . Assigning responsibility for acquiring the data
B . Locating the data and preserving the integrity of the data
C . Creating a forensically sound image
D . Issuing a litigation hold to all affected parties
Answer: B
Explanation:
Locating the data and preserving data integrity is the only correct answer because it represents the primary responsibility of an investigator and is a complete and accurate statement of the first priority. While assigning responsibility for acquiring the data is a step that should be taken, it is not the first step or the highest priority. Creating a forensically sound image may or may not be a necessary step, depending on the type of investigation, but it would never be the first priority. Issuing a litigation hold to all affected parties might be a necessary step early on in an investigation of certain types, but not the first priority.