A timestamp shows file creation after seizure. What should be checked?

A. Whether evidence was altered or time zones were misinterpreted B. Whether fonts changed C. Whether monitor brightness changed D. Whether keyboard was cleaned