In the course of examining a computer system for forensic evidence, data on the suspect media were
inadvertently altered. Which of the following should have been the FIRST course of action in the investigative
process?
A.
Perform a backup of the suspect media to new media.
B.
Perform a bit-by-bit image of the original media source onto new media.
C.
Make a copy of all files that are relevant to the investigation.
D.
Run an error-checking program on all logical drives to ensure that there are no disk errors.