Which of the following is highly recommended for a system to be used as evidence in a legal
procedure?

A.
A memory dump

B.
A forensic report

C.
A chain of custody

D.
An image of the drive

Explanation: