Which of the following is MOST important when conducting a forensic investigation?

A. Documenting analysis steps
B. Capturing full system images
C. Maintaining a chain of custody
D. Analyzing system memory