As a forensic investigator, you’re looking into a case of industrial espionage at a manufacturing...

Option D is the best answer because the system has already been shut down , meaning volatile evidence is likely lost and the remaining priority is to preserve and acquire non-volatile data in the most forensically sound manner possible. CHFI v11 emphasizes data acquisition methodology , choosing the best acquisition method , preserving evidence integrity, and using controlled procedures to avoid altering the source media. In this situation, removing the hard drive and attaching it to a forensic workstation is the safest and most standard approach for acquiring a reliable disk image.

Booting the suspect computer, whether with a forensic boot disk or the normal operating system, introduces risk because any boot process can change file system metadata, logs, temporary files, or other artifacts. Using the normal OS is especially unsafe. Network-based acquisition is also not appropriate here because the machine is already isolated and powered down.

A direct forensic acquisition from the removed drive minimizes unnecessary changes to the evidence source and aligns with CHFI principles of preservation, controlled handling, and repeatable imaging . Therefore, the correct next step for non-volatile data acquisition is to remove the drive and image it from a forensic workstation.