Tony is conducting a forensic investigation with evidence collected from a backup.

Why is this not correct?

a$.$ Backups can be used as far as the specific tool is listed on NIST list of certified tools

b$.$ Backups do not contain unallocated space or deleted files

c$.$ This actually correct and one of the methods used by forensic investigators

d$.$ Backups do not contain the timestamps of files