Page 74 - Expert Witness

— Emails

 Type of server (in-house or external)

 Determine where the data is stored and maintained.

— Individual’s computer, network server, flash drive, CD or DVD, mobile device, and so on

— Make and model of the computer or device

— Type of network

 Determine who has access to the data.

— What type of operating system?

— Who has administrator rights?

— Is there an access code?

— When was the data (or system) last accessed?

 The more activity that has occurred, the less likely of finding historical data.

 Consider collection and preservation.

— Imaging — make a mirror of the original data:

 Forensic computer technicians often have special tools to enable imaging.

— Evidence should be protected from physical, mechanical, or electromagnetic damage.

72 © 2020 Association of International Certified Professional Accountants