A compromised workstation utilized in a Distributed Denial of Service (DDOS) attack has been removed from
the network and an image of the hard drive has been created. However, the system administrator stated that
the system was left unattended for several hours before the image was created. In the event of a court case,
which of the following is likely to be an issue with this incident?

A.
Eye Witness

B.
Data Analysis of the hard drive

C.
Chain of custody

D.
Expert Witness

Explanation:
Chain of custody deals with how evidence is secured, where it is stored, and who has access to it. When you
begin to collect evidence, you must keep track of that evidence at all times and show who has it, who has seen
it, and where it has been. The evidence must always be within your custody, or you’re open to dispute about
possible evidence tampering.