Which of the following incident response procedures BEST allows Sara, the security technician, to identify who had possession of a hard drive prior to forensics analysis?

Which of the following incident response procedures BEST allows Sara, the security technician, to identify who had possession of a hard drive prior to forensics analysis?







A. Chain of custody

B. Tracking man hours

C. Witnesses

D. Capturing system images





Answer: A


Computer Science

Learn More Multiple Choice Question :