A customer is terminating an employee for suspected activity that is against company policy. They have called Emily to consult with them on how to best preserve any evidence the company may be required to provide in court. Which of the following would BEST preserve the integrity of the data and best serve the client?
A. Create an image of the hard drive and store it on a NTFS drive.
B. Remove and secure any HDD from the computer, documenting the process.
C. Store the computer in the server room until it is required.
D. Lock the user out of the computer and let another employee use it until needed.