Which of the following should the security administrator do when taking a forensic image of a hard drive?

Which of the following should the security administrator do when taking a forensic image of a hard drive?

A.
Image the original hard drive, hash the image, and analyze the original hard drive.

B.
Copy all the files from the original into a separate hard drive, and hash all the files.

C.
Hash the original hard drive, image the original hard drive, and hash the image.

D.
Image the original hard drive, hash the original hard drive, and analyze the hash.