Which of the following incident response procedures BEST allows Sara, the security technician, to identify who had possession of a hard drive prior to forensics analysis?
A.
Chain of custody
B.
Tracking man hours
C.
Witnesses
D.
Capturing system images