Winnie has collected the physical evidence of an attack on her company’s Web site, including the
Web server, hard disk drives, site traffic and firewall logs. Which less tangible evidence could be
lost?

A.
User authentication data

B.
System data stored in RAM

C.
IP address traceroute data

D.
ISP router records