An incident handler needs to preserve evidence for possible litigation. Which of the following will the incident handler MOST likely do to preserve the evidence?

Encrypting the files does not preserve the original state for forensic analysis and could alter timestamps or other metadata.

Cloning impacted hard drives creates a bit-for-bit copy of the original evidence, ensuring that the original state is preserved without alteration and can be analyzed forensically. This step is critical in maintaining the integrity and admissibility of digital evidence for potential litigation.

Contacting the cyber insurance company is an administrative step related to incident response but does not directly preserve digital evidence.

Informing law enforcement is part of the reporting aspect of an incident but does not directly preserve the technical evidence itself.