During incident recovery, which of the following is the BEST approach to ensure the eradication of traces hidden by an attacker?

Reinstalling the system from a known clean, original source, often from trusted gold images or baseline configurations, is the most thorough and reliable method to ensure that all traces of an attacker, including rootkits, hidden malware, or modified system files, are completely eradicated. This guarantees a clean operational environment.

Continuous monitoring helps detect new or re-emerging threats but cannot guarantee that all existing hidden traces from a past attack have been eradicated.

Prohibiting use of a compromised account is a containment and remediation step, but it doesn't eradicate hidden traces or malware left behind on the system by an attacker.

A forensic investigation is for acquiring evidence and understanding the attack, not for the eradication of attacker traces from the compromised system itself.