Which is a standard procedure to perform during all computer forensics investigations?

A.
with the hard drive removed from the suspect PC, check the date and time in the systems
CMOS

B.
with the hard drive in the suspect PC, check the date and time in the File Allocation Table

C.
with the hard drive removed from the suspect PC, check the date an d time in the systems RAM

D.
with the hard drive in the suspect PC, check the date and time in the systems CMOS