Which of the following would provide the BEST evidence for use in a forensic investigation of an employee's hard drive?

A. A file level copy of the hard drive
B. Bit-stream copy of the hard drive
C. Memory dump to an external hard drive
D. Prior backups