A Forensics Analyst Is Investigating a Hard Drive for Evidence

A forensics analyst is investigating a hard drive for evidence of suspected illegal activity. Which of the following should the analyst do FIRST?

A) Create a hash of the hard drive.
B) Export the Internet history.
C) Save a copy of the case number and date as a text file in the root directory.
D) Back up the pictures directory for further inspection.