Sarah, a CHFI investigator, is assigned to a case involving potential child exploitation material distributed...

Option D is the best answer because the question explicitly emphasizes legal compliance , court admissibility , and the sensitive nature of the investigation. In CHFI methodology, the forensic examiner must first ensure there is proper legal authority before collecting evidence, especially when investigating criminal conduct involving private systems or networks. A lawful foundation is necessary to protect the integrity and admissibility of the evidence.

Obtaining a search warrant before proceeding ensures that the collection process is authorized and defensible. This is especially important in cases involving severe criminal allegations, where improper access could undermine the entire prosecution. Once legal authority is secured, the investigator can then proceed with monitoring, evidence preservation, and deeper technical analysis under the proper process.

Options A and C involve deceptive or unauthorized access and would create legal and ethical problems. Option B may be useful later, but it should not come before obtaining formal legal authorization. Therefore, the most appropriate first step is to obtain a search warrant based on the initial report and proceed through proper forensic and legal channels.