In the initial stages of an incident response, Matt, the security administrator, was provided the hard drives in question from the incident manager. Which of the following incident response…

Taking cryptographic hashes (such as MD5 or SHA-256) of the original drives creates a verifiable fingerprint that proves the evidence has not been altered, which is essential for forensic integrity and court admissibility.

Chain of custody documentation should have begun the moment the drives were collected, not at the analysis stage - it was already initiated before the drives were handed over.

Screenshots capture live screen state and are not applicable to offline hard drives that have already been removed from a running system.

Capturing a forensic system image creates an exact bit-level copy on which all analysis is performed, preserving the original evidence untouched and ensuring that the investigation process itself cannot alter or destroy potential evidence.

Decompiling suspicious files is a deeper analysis step that occurs after the image has been captured and verified, not during the initial preparation phase.