An Employee Has Been Charged with Fraud and Is Suspected

Multiple Choice

An employee has been charged with fraud and is suspected of using corporate assets. As authorities collect evidence, and to preserve the admissibility of the evidence, which of the following forensic techniques should be used?

A) Order of volatility
B) Data recovery
C) Chain of custody
D) Non-repudiation