A system administrator is responding to a legal order to turn over all logs from all company
servers. The system administrator records the system time of all servers to ensure that:

A.
HDD hashes are accurate.

B.
the NTP server works properly.

C.
chain of custody is preserved.

D.
time offset can be calculated.

Explanation:
It is quite common for workstation times to be off slightly from actual time, and that can happen
with servers as well. Since a forensic investigation is usually dependent on a step-by-step account
of what has happened, being able to follow events in the correct time sequence is critical. Because
of this, it is imperative to record the time offset on each affected machine during the investigation.
One method of assisting with this is to add an entry to a log file and note the time that this was
done and the time associated with it on the system.