Which is a standard procedure to perform during all computer forensics investigations?

Which is a standard procedure to perform during all computer forensics investigations?
A . with the hard drive removed from the suspect PC, check the date and time in the system’s CMOS
B . with the hard drive in the suspect PC, check the date and time in the File Allocation Table
C . with the hard drive removed from the suspect PC, check the date and time in the system’s RAM
D . with the hard drive in the suspect PC, check the date and time in the system’s CMOS

Answer: A