You have been asked to investigate the possibility of computer fraud in the finance department of
a company. It is suspected that a staff member has been committing finance fraud by printing
cheques that have not been authorizeD. You have exhaustively searched all data files on a bitmap
image of the target computer, but have found no evidence. You suspect the files may not have
been saveD. What should you examine next in this case?

A.
The registry

B.
Theswapfile

C.
The recycle bin

D.
The metadata