A company hired a penetration tester to do a social-engineering test against its employees. Although the tester did not find any employees' phone numbers on the...

A company hired a penetration tester to do a social-engineering test against its employees. Although the tester did not find any employees' phone numbers on the company's website, the tester has learned the complete phone catalog was published there a few months ago.
In which of the following places should the penetration tester look FIRST for the employees' numbers?

A. Web archive B. GitHub C. File metadata D. Underground forums