A compromised workstation utilized in a Distributed Denial of Service (DDOS) attack has
been removed from the network and an image of the hard drive has been created. However,
the system administrator stated that the system was left unattended for several hours before
the image was created. In the event of a court case, which of the following is likely to be an
issue with this incident?
A.
Eye Witness
B.
Data Analysis of the hard drive
C.
Chain of custody
D.
Expert Witness