The security manager received a report that an employee was involved in illegal activity and has
saved data to a workstation’s hard drive. During the investigation, local law enforcement’s criminal
division confiscates the hard drive as evidence. Which of the following forensic procedures is
involved?

A.
Chain of custody

B.
System image

C.
Take hashes

D.
Order of volatility