When conducting a compliance investigation, which action best preserves the integrity of electronic evidence?
-
A
Copying files to a shared network drive
-
B
Creating a forensic image of the original storage media
-
C
Deleting duplicate files to simplify review
-
D
Forwarding emails to personal accounts for safekeeping