An employee has been charged with fraud and is suspected of using corporate assets. As authorities collect evidence, and to preserve the admissibility of the evidence, which of the following forensic techniques should be used? 

Answer options:

A. Order of volatility
B. Data recovery
C. Chain of custody
D. Non-repudiation

C