An incident team must explain every transfer of a collected disk image. Which record supports that need?

1. The endpoint's wallpaper history
2. A software feature roadmap
3. The analyst's personal calendar only
4. Chain of custody