What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 sever the course of its lifetime?

What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 sever the course of its lifetime?

A.
forensic duplication of hard drive

B.
analysis of volatile data

C.
comparison of MD5 checksums

D.
review of SIDs in the Registry