What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 sever the course of its lifetime?

What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 sever the course of its lifetime?
A . forensic duplication of hard drive
B . analysis of volatile data
C . comparison of MD5 checksums
D . review of SIDs in the Registry

Answer: C