Which of the following incident response procedures BEST allows Sara, the security technician, to
identify who had possession of a hard drive prior to forensics analysis?

A.
Chain of custody

B.
Tracking man hours

C.
Witnesses

D.
Capturing system images