You have been asked to investigate the possibility of computer fraud in the finance department of a company.
It is suspected that a staff member has been committing finance fraud by printing cheques that have not been
authorized. You have exhaustively searched all data files on a bitmap image of the target computer, but have
found no evidence. You suspect the files may not have been saved. What should you examine next in this
case?

A.
The registry

B.
The swap file

C.
The recycle bin

D.
The metadata