The security manager received a report that an employee was involved in illegal activity and has
saved data to a workstation’s hard drive. During the investigation, local law enforcement’s criminal
division confiscates the hard drive as evidence. Which of the following forensic procedures is
involved?

A.
Chain of custody

B.
System image

C.
Take hashes

D.
Order of volatility

Explanation:
Chain of custody deals with how evidence is secured, where it is stored, and who has access to it.
When you begin to collect evidence, you must keep track of that evidence at all times and show
who has it, who has seen it, and where it has been.