During a trial, a judge determined evidence gathered from a hard drive was not admissible. Which of the
following BEST explains this reasoning?


A. The forensic investigator forgot to run a checksum on the disk image after creation.
B. The chain of custody form did not note time zone offsets between transportation regions.
C. The computer was turned off, and a RAM image could not be taken at the same time.
D. The hard drive was not properly kept in an antistatic bag when it was moved.