What Is the BEST Method If an Investigator Wishes to Analyze

What is the BEST method if an investigator wishes to analyze a hard drive which may be used as evidence?

A) Leave the hard drive in place and use only verified and authenticated Operating Systems (OS) utilities to analyze the contents
B) Log into the system and immediately make a copy of all relevant files to a Write Once, Read Many (WORM) device
C) Remove the hard drive from the system and make a copy of the hard drive's contents using imaging hardware
D) Use a separate bootable device to make a copy of the hard drive before booting the system and analyzing the hard drive