During a trial, a judge determined evidence gathered from a hard drive was not admissible. Which of the following BEST explains this reasoning?

A. The forensic investigator forgot to run a checksum on the disk image after creation.

B. The chain of custody form did not note time zone offsets between transportation regions.

C. The computer was turned off, and a RAM image could not be taken at the same time.

D. The hard drive was not properly kept in an antistatic bag when it was moved.





 

Correct Answer: B

This question is in SY0-601 exam
For getting CompTIA Security+ certificate