A user has been reported for storing prohibited material on a company owned PC. The
accused user is notified and an investigation is launched. However, no evidence is found
and it is believed that the user was able to delete all relevant evidence. Which of the
following would prevent this from happening in the future?

A.
Change documentation

B.
Chain of Custody

C.
Automatic notifications for complaints

D.
Data preservation