The source workstation image for new accounting PCs has begun blue-screening. A technician notices that the
date/time stamp of the image source appears to have changed. The desktop support director has asked the
Information Security department to determine if any changes were made to the source image. Which of the
following methods would BEST help with this process? (Select TWO).

A.
Retrieve source system image from backup and run file comparison analysis on the two images.

B.
Parse all images to determine if extra data is hidden using steganography.

C.
Calculate a new hash and compare it with the previously captured image hash.

D.
Ask desktop support if any changes to the images were made.

E.
Check key system files to see if date/time stamp is in the past six months.