During incident response, which of the following procedures would identify evidence tampering by
outside entities?

A.
Hard drive hashing

B.
Annualized loss expectancy

C.
Developing audit logs

D.
Tracking man hours and incident expenses

Explanation: