During incident response, which of the following procedures would identify evidence tampering by out

During incident response, which of the following procedures would identify evidence tampering by outside entities?

A.
Hard drive hashing

B.
Annualized loss expectancy

C.
Developing audit logs

D.
Tracking man hours and incident expenses