A system administrator suspects that /etc/passwd or /etc/shadow has been modified without proper authorization. Which two methods or programs can be used to find out whether that happened? (Choose two.)

A.
bart

B.
pkgchk

C.
pwdsign

D.
file system backups

E.
the Solaris Fingerprint Database