: 6. Which of the following needs to be performed during a forensics investigation to ensure the data contained in a drive image has not been compromised?

1. Follow the proper chain of custody procedures.
2. Compare the image hash to the original hash.
3. Ensure a legal hold has been placed on the image.
4. Verify the time of the image file.