Roberto, a certified CHFI professional, is faced with a complex case.

Option C is the best answer because CHFI v11 strongly emphasizes preserving original evidence , following data acquisition methodology , creating proper forensic duplicates, and maintaining chain of custody and best practices for handling digital evidence . It also includes validating data acquisition and legal concepts such as rules of evidence and evidence admissibility.

When dealing with encrypted hard drives, the correct forensic approach is first to create bit-by-bit copies and then perform all decryption attempts, cracking, or examination on the copies. This protects the original media from alteration, preserves the evidentiary record, and aligns with the best evidence principle by ensuring the originals remain intact and available for later verification or courtroom scrutiny.

Option A may be part of later analysis, but not on the original media. Option B introduces unnecessary exposure and evidentiary risk. Option D would destroy evidence. Therefore, the most defensible and CHFI-aligned method is to image the encrypted drives first and work only from the forensic copies , leaving the originals untouched.