Question 663:
Which of the following is MOST helpful when establishing the authenticity of digital evidence collected from a hard disk?
Answer options:
A. Bit-by-bit image of the hard disk B. Hash of the files on the hard disk C. Chain of custody documentation D. Confirmation by witnesses