An investigator is working on a digital forensics case involving a suspected data breach.

According to theCHFI v11 Data Acquisition Concepts and Rules,sanitizing the target mediais a critical preparatory step performed before acquiring forensic data, especially when reusing storage media or handling sensitive information. Sanitization refers to the process ofsecurely erasing dataso that it cannot be recovered using forensic techniques. This is typically achieved byoverwriting the storage media with predefined patterns, such as sequential zeros and ones, or by using approved data wiping algorithms.

CHFI v11 clearly distinguishes sanitization from other acquisition steps.Validating data acquisitionensures the integrity and completeness of collected evidence through hash verification and comparison, not data destruction.Acquiring volatile datafocuses on capturing live information such as RAM contents, running processes, and network connections before shutdown.Planning for contingencyinvolves preparing backups, alternate tools, and procedures in case the acquisition process fails.

The scenario explicitly describes overwriting the drive to prevent any residual data recovery, which directly aligns with the CHFI v11 guideline“Sanitize the Target Media”listed under evidence handling and acquisition best practices. This step ensures privacy, prevents data leakage, and maintains legal and ethical compliance during forensic operations.

Therefore, based strictly on CHFI v11 objectives and terminology, the investigator is performingsanitization of the target media, makingOption Dthe correct and verified answer.