Which of the following is an example of evidence collected from metadata?

Question $25$ options:

A$)$

Drive file slack

B$)$

RAM slack

C$)$

Time stamp

D$)$

Chain of custody